Malicious Code Injection in cook-soluble-pot Package
Summary
MAL-2025-100991: Malicious code in cook-soluble-pot (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cook-soluble-pot package is part of the npm ecosystem, primarily used for managing dependencies in JavaScript applications. It is often utilized in various projects to facilitate the development process. However, this package has been identified as part of a malicious campaign that aims to exploit npm's publishing system, leading to potential security risks for developers and their applications.
Vulnerability Detail
The vulnerability in the cook-soluble-pot package originates from its association with a malicious campaign that floods the npm registry with derivative packages. These packages contain scripts designed to automatically modify package.json files, removing private flags and changing version numbers. The malicious payload generates random package names and continuously republishes variants, which can lead to reputation inflation for malicious actors and pollution of the npm registry. This poses significant risks, including the potential for dependency confusion and the introduction of harmful code into legitimate projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cook-soluble-potIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the cook-soluble-pot package and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using tools like Vulert to monitor your package dependencies for vulnerabilities.
Conclusion
The cook-soluble-pot package has been identified as a vector for malicious code injection, posing significant risks to developers and their applications. It is crucial to remove this package and monitor your dependencies for vulnerabilities using tools like Vulert to ensure the security of your projects.
See every vulnerability recorded for cook-soluble-pot →
FAQ
The cook-soluble-pot package is an npm package used in JavaScript applications, but it has been identified as part of a malicious campaign.
The vulnerability can lead to the introduction of malicious code into your application, potentially compromising its security and functionality.
If you have installed the cook-soluble-pot package, you should uninstall it immediately using the command: npm uninstall cook-soluble-pot.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
