Malicious Code Injection in cucumber-notthedevs Package
Summary
MAL-2025-101135: Malicious code in cucumber-notthedevs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cucumber-notthedevs package is an npm library that is likely used for testing and behavior-driven development (BDD) in JavaScript applications. It is part of a larger ecosystem that facilitates the creation of automated tests. However, this package has been compromised, making it susceptible to malicious activities that can affect developers and their projects.
Vulnerability Detail
The vulnerability in the cucumber-notthedevs package originates from its association with a malicious campaign that floods the npm registry with harmful packages. This specific package contains scripts designed to automatically modify its own package.json file, removing private flags and changing version numbers. It generates random package names, which can lead to pollution of the npm registry and potential exploitation of developers who unknowingly use these compromised packages. The ramifications include loss of control over project dependencies and potential security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cucumber-notthedevsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not possible, consider removing the cucumber-notthedevs package from your project and replacing it with a trusted alternative. You can do this by running: 'npm uninstall cucumber-notthedevs'. Additionally, monitor your package-lock.json file for any suspicious changes.
Conclusion
The cucumber-notthedevs package has been compromised, leading to significant security vulnerabilities. It is essential for developers to take immediate action by updating or removing the package to protect their projects. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for cucumber-notthedevs →
FAQ
It is an npm package used for testing and behavior-driven development in JavaScript applications.
The vulnerability can lead to unauthorized modifications of your project dependencies, potentially introducing malicious code.
You should immediately update or uninstall the package to prevent any security risks.
Yes, you can use Vulert to monitor your package-lock.json file for open-source vulnerabilities in real-time.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
