Malicious Code Detected in cw-isdk Package: Version 20.0.0 and Beyond
Summary
MAL-2026-1420: Malicious code in cw-isdk (npm). Affects cw-isdk versions 20.0.0 – 34.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cw-isdk package is a JavaScript library available on npm, designed to facilitate integration with various cloud services. It provides developers with tools to streamline their application development processes. However, recent analysis has revealed that certain versions of this package contain malicious code that poses significant security risks to users.
Vulnerability Detail
The cw-isdk package has been identified as malicious due to its communication with a domain linked to harmful activities and its execution of commands associated with malicious behavior. This vulnerability can lead to unauthorized access, data breaches, and potential exploitation of the systems using the affected package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cw-isdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the cw-isdk package from their project until a secure version is confirmed. This can be done using the command: npm uninstall cw-isdk. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The cw-isdk package has been flagged for containing malicious code that can compromise user security. It is imperative for developers to update to the latest version or remove the package entirely to mitigate risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for cw-isdk →
FAQ
Versions 20.0.0, 22.0.0, 25.0.0, 26.0.0, 31.0.0, 32.0.0, 33.0.0, and 34.0.0 are identified as malicious.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your package-lock.json file to Vulert's playground at Vulert Scanner to check for vulnerabilities.
Consider removing the cw-isdk package from your project as a temporary measure until a secure version is available.
While updating the package is essential for security, always back up your project before making updates to avoid potential data loss due to breaking changes.
Detailed information about the vulnerability can be found on the OpenSSF Package Analysis project page and the GitHub repository for malicious packages.
