Malicious Code Detected in corstoken Package: Version 2.14.7 Vulnerability
Summary
MAL-2026-1051: Malicious code in corstoken (npm). Affects corstoken versions 2.14.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'corstoken' package, available on npm, is designed to facilitate secure token generation for cross-origin resource sharing (CORS). It is widely used in web applications to manage API access and enhance security. However, version 2.14.7 has been identified as malicious, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability in the 'corstoken' package arises from its ability to communicate with a domain linked to malicious activities. Furthermore, it executes commands that are associated with harmful behavior, potentially compromising the security of applications that utilize this package. This could lead to unauthorized access, data breaches, and other forms of exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall corstokenIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the 'corstoken' package altogether until a secure version is confirmed. If your application relies on it, consider implementing alternative methods for secure token generation that do not involve this package.
Conclusion
The discovery of malicious code in the 'corstoken' package version 2.14.7 poses serious risks to applications that utilize it. Users are strongly advised to uninstall this version and seek secure alternatives. Regular monitoring and updates are crucial to maintaining application security.
See every vulnerability recorded for corstoken →
FAQ
The 'corstoken' package is used for generating secure tokens for CORS, helping to manage API access and enhance security in web applications.
The vulnerability allows the package to communicate with malicious domains and execute harmful commands, which can lead to unauthorized access and data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
There is no patch for version 2.14.7 as it is considered malicious. It is recommended to uninstall this version and install a secure alternative.
If immediate updates are not possible, consider implementing alternative secure token generation methods and monitor your application closely for any suspicious activity.
