Critical Malicious Code Vulnerability in command-irail Package
Summary
MAL-2025-191391: Malicious code in command-irail (npm). Affects command-irail versions 0.5.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The command-irail package is a Node.js library designed for interacting with the rail transport system. It provides functionalities for querying train schedules and ticketing information. However, this package has been compromised, making it susceptible to severe security threats, including unauthorized access to sensitive user data.
Vulnerability Detail
The vulnerability originates from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is capable of stealing user tokens and credentials, subsequently publishing them to GitHub. It can also propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. Additionally, there is a risk that the worm may destroy the user's home directory, leading to significant data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall command-irailIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the command-irail package from their project until a secure version is confirmed. This can be done using the command: npm uninstall command-irail.
Conclusion
The command-irail package has a critical vulnerability due to malicious code introduced by an NPM worm. Users are strongly advised to update the package to the latest version or uninstall it to protect their sensitive information and maintain the integrity of their applications.
See every vulnerability recorded for command-irail →
FAQ
The command-irail package is a Node.js library that allows users to interact with rail transport systems for querying schedules and ticketing.
The package was compromised by the Sha1-Hulud: The Second Coming NPM worm, which introduced malicious code into the package.
The risks include unauthorized access to sensitive tokens and credentials, potential data loss, and the propagation of the worm to other NPM packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updating is not possible, consider uninstalling the package as a temporary measure to mitigate risks.
