Malicious Code Detected in conp-dats-editor: npm Package Vulnerability
Summary
MAL-2026-772: Malicious code in conp-dats-editor (npm). Affects conp-dats-editor versions 999.999.992. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The conp-dats-editor is an npm package designed for editing and managing datasets within the Canadian Open Neuroscience Platform. It provides functionalities that facilitate data manipulation and visualization. However, this package has been flagged for malicious behavior, which poses significant risks to users and their systems.
Vulnerability Detail
The vulnerability in the conp-dats-editor package arises from the execution of commands associated with malicious behavior. This was identified by the OpenSSF Package Analysis project, which flagged version 999.999.992 as malicious. The implications of this vulnerability include potential unauthorized access to user systems, data breaches, and the execution of harmful scripts that could compromise system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall conp-dats-editorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the conp-dats-editor package and seek alternative packages that provide similar functionalities without the associated risks. Additionally, monitoring tools like Vulert can be employed to keep track of vulnerabilities in your dependencies.
Conclusion
The conp-dats-editor package has been identified as malicious, posing significant risks to users. It is crucial to uninstall this package and monitor for updates or alternatives. Utilizing tools like Vulert can help maintain the security of your software dependencies.
See every vulnerability recorded for conp-dats-editor →
FAQ
The conp-dats-editor is an npm package used for editing and managing datasets within the Canadian Open Neuroscience Platform.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged the package based on its execution of harmful commands.
If you have the conp-dats-editor package installed, you should uninstall it immediately using the command: npm uninstall conp-dats-editor.
Yes, users can look for alternative npm packages that offer similar functionalities without the associated risks.
You can use tools like Vulert, which monitors and alerts you in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
