Malicious Code Detected in dc-extras Package - Security Alert
Summary
MAL-2025-192694: Malicious code in dc-extras (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dc-extras package is a Node.js library commonly used in various applications to extend functionalities. It provides additional features that enhance the core capabilities of other packages. However, it has recently been flagged for containing malicious code, posing a significant risk to users and their applications.
Vulnerability Detail
The vulnerability originates from the dc-extras package, which has been identified to contain malicious code. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other malicious activities. The specific technical details of the malicious code have not been disclosed, but its presence in the package is a serious concern for developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dc-extrasIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the dc-extras package from your project by executing the following command: 'npm uninstall dc-extras'. This will prevent any potential exploitation of the malicious code until a secure version is released.
Conclusion
The detection of malicious code in the dc-extras package poses a significant threat to applications that utilize it. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for dc-extras →
FAQ
dc-extras is a Node.js library that provides additional functionalities to enhance other packages.
The malicious code was identified through an analysis conducted by Amazon Inspector, which flagged the package for containing harmful code.
Using the dc-extras package with malicious code can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
