Malicious Code Detected in conduit-utils Package: Version 2.95.0
Summary
MAL-2026-985: Malicious code in conduit-utils (npm). Affects conduit-utils versions 2.95.0 – 3.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The conduit-utils package is a utility library for Node.js applications, providing various functions to facilitate development tasks. It is widely used in the npm ecosystem for its ease of integration and functionality. However, version 2.95.0 has been flagged for malicious behavior, specifically for communicating with a domain linked to harmful activities.
Vulnerability Detail
The vulnerability in conduit-utils arises from its version 2.95.0, which has been identified as malicious by the OpenSSF Package Analysis project. This version communicates with a domain associated with malicious activity, posing a risk of data leakage or unauthorized access to sensitive information. The malicious nature of the package can lead to severe ramifications for applications relying on it, including potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall conduit-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider removing conduit-utils from your project and replacing it with alternative libraries that provide similar functionality without the associated risks.
Conclusion
The conduit-utils package version 2.95.0 has been flagged for malicious activity, posing significant risks to applications that utilize it. Users are advised to update to the latest version or find alternative libraries to mitigate these risks. Tools like Vulert can assist in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for conduit-utils →
FAQ
Conduit-utils is a utility library for Node.js that offers various functions to streamline development tasks.
The malicious behavior was identified by the OpenSSF Package Analysis project, which monitors packages for security issues.
Using the affected version can lead to data leakage, unauthorized access, and potential exploitation by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider removing conduit-utils and replacing it with safer alternatives.
