Malicious Code Vulnerability in cwanner Package
Summary
MAL-2025-191572: Malicious code in cwanner (npm). Affects cwanner versions 9.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cwanner package is an npm module designed for web scraping and data collection. It provides users with tools to automate the process of gathering information from websites. However, this package has been identified to contain malicious code that can compromise user systems, making it crucial for users to be aware of its vulnerabilities.
Vulnerability Detail
The cwanner package has been found to contain malicious code that can execute unauthorized actions on the user's system. This vulnerability originated from a compromised version of the package (version 9.2.0) and can lead to data theft, system compromise, or other malicious activities. Users who have installed this version are at risk of having their systems manipulated by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cwannerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the cwanner package from their projects until a secure version is confirmed. This can be done using the command: npm uninstall cwanner.
Conclusion
The cwanner package has been identified to contain malicious code that poses a significant risk to users. It is essential to update or remove the affected package to protect systems from potential threats. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for cwanner →
FAQ
The cwanner package is an npm module used for web scraping and data collection.
The malicious code can execute unauthorized actions, potentially leading to data theft or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the affected version and update to the latest secure version of the cwanner package.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights.
