Critical Malicious Code Vulnerability in css-dedoupe Package
Summary
MAL-2025-190953: Malicious code in css-dedoupe (npm). Affects css-dedoupe versions 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-dedoupe package is a tool used in the npm ecosystem for optimizing CSS files by removing duplicate styles. It is designed to enhance performance and reduce file size in web applications. However, this package has been found to contain malicious code, posing significant security risks to systems that utilize it.
Vulnerability Detail
The css-dedoupe package has been identified to harbor malicious code that compromises the security of any system where it is installed. This vulnerability originates from two sources: Amazon Inspector and GHSA Malware, which have confirmed the presence of embedded malicious code. Systems running this package should be considered fully compromised, and all sensitive information, such as secrets and keys, must be rotated immediately. The malicious code may persist even after the package is removed, indicating a severe risk to system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-dedoupeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to avoid using the css-dedoupe package altogether until a secure version is released. If you need similar functionality, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The css-dedoupe package has been identified as containing malicious code, posing a significant security threat to systems using it. Immediate action is required to uninstall the package and secure sensitive information. Users should remain vigilant and consider using alternative solutions until a safe version is available.
See every vulnerability recorded for css-dedoupe →
FAQ
css-dedoupe is an npm package designed to optimize CSS files by removing duplicate styles, improving performance and reducing file size.
The malicious code can compromise your system's security, potentially allowing unauthorized access to sensitive information and control over your machine.
You should immediately uninstall the css-dedoupe package and rotate any sensitive information stored on your system.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without needing to sign up.
While removing the package is essential, there is no guarantee that all malicious software will be removed. It is advisable to take additional security measures.
