Critical Malicious Code Vulnerability in confluence-analytics-support Package
Summary
MAL-2026-741: Malicious code in confluence-analytics-support (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The confluence-analytics-support package is an npm library designed to provide analytics support for Confluence applications. It is utilized by developers to integrate analytics functionalities seamlessly into their projects. However, this package has been identified to contain malicious code that poses significant security risks to any system where it is installed.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the confluence-analytics-support package. This code can compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users should be aware that simply removing the package may not eliminate all traces of the malicious software, as full control of the affected system may have been granted to an outside entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall confluence-analytics-supportIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if you need to maintain analytics functionality, consider using an alternative package that provides similar features without the associated risks. Always ensure that any package you choose is from a reputable source and has been reviewed for security vulnerabilities.
Conclusion
The confluence-analytics-support package has been identified as containing malicious code that poses serious security risks. Immediate action is required to uninstall the package and secure any sensitive information. Regular monitoring of dependencies is essential to prevent future vulnerabilities.
See every vulnerability recorded for confluence-analytics-support →
FAQ
Immediately uninstall the package using 'npm uninstall confluence-analytics-support' and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Leaving the package installed can lead to unauthorized access to sensitive data, potential data breaches, and full compromise of your system.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, which can alert you in real-time for open-source vulnerabilities.
Always review alternative packages for security vulnerabilities and ensure they come from reputable sources before integrating them into your projects.
