Critical Malicious Code Vulnerability in Confluent-Kafka Package
Summary
MAL-2025-192405: Malicious code in confluent-kafka (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Confluent-Kafka is an npm package that provides a client for Apache Kafka, enabling developers to produce and consume messages in a distributed system. It is widely used for building real-time data pipelines and streaming applications. However, the package has been compromised, leading to significant security concerns for users who have it installed.
Vulnerability Detail
The vulnerability originates from the presence of malicious code within the Confluent-Kafka package. Any system with this package installed is considered fully compromised, as it may allow unauthorized access to sensitive information, including secrets and keys. The malicious code can lead to severe ramifications, including data breaches and loss of control over the affected systems. Users are advised to treat any system running this package as potentially compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall confluent-kafkaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should uninstall the Confluent-Kafka package using the following command: npm uninstall confluent-kafka. However, be aware that simply removing the package may not eliminate all traces of the malicious software that may have been installed.
Conclusion
The Confluent-Kafka package has been compromised with malicious code, posing serious security risks to users. Immediate action is required to uninstall the package and secure any sensitive information. Stay vigilant and monitor for updates regarding a patched version.
See every vulnerability recorded for confluent-kafka →
FAQ
Immediately uninstall the package and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
Currently, there is no patch available. Users are advised to uninstall the package until a secure version is released.
Leaving the package installed poses significant risks, including unauthorized access to sensitive data and potential control over your system by malicious actors.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights without requiring access to the code.
