Critical Malicious Code Vulnerability in common-fs Package
Summary
MAL-2026-17300: Malicious code in common-fs (npm). Affects common-fs versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The common-fs package is a filesystem and transaction helper designed for use in Node.js applications. It provides functionalities to manage file operations and transactions efficiently. However, it has been found to contain malicious code that can execute arbitrary JavaScript in the caller's process, posing significant security risks.
Vulnerability Detail
The vulnerability originates from an obfuscated code loader within the common-fs package. The index.js file reconstructs critical identifiers and executes code from a sibling file, use.js, which is not merely data but a payload container. This allows an attacker to run JavaScript with full access to the host's filesystem and network, leading to potential data exfiltration and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall common-fsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the common-fs package until it has been patched. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The common-fs package contains a critical vulnerability that allows for the execution of malicious code, posing serious security risks. It is essential to update the package to the latest version to mitigate these risks. Users should also consider using alternative packages and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for common-fs →
FAQ
common-fs is a Node.js package that helps manage filesystem operations and transactions.
The vulnerability allows attackers to execute arbitrary code in your application, potentially leading to data theft and system compromise.
Yes, updating to the latest version of the common-fs package will address the vulnerability.
As a workaround, refrain from using the common-fs package until a patch is applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
