Critical Malicious Code Vulnerability in detect-cache Package
Summary
MAL-2026-957: Malicious code in detect-cache (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The detect-cache package is a Node.js library used for caching detection in applications. It helps developers manage cache efficiently, improving application performance. However, this package has been compromised, leading to severe security risks for any system utilizing it.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the detect-cache package, identified as GHSA-87gx-xxm8-25x2. Any system with this package installed is considered fully compromised, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code poses significant risks, as it may lead to data breaches or system takeovers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall detect-cacheIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to uninstall the detect-cache package using the command: npm uninstall detect-cache. This action should be taken promptly to mitigate the risks associated with the malicious code.
Conclusion
The detect-cache package has been compromised with malicious code, posing significant risks to any system using it. Immediate action is required to uninstall the package and secure sensitive information. Monitoring tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for detect-cache →
FAQ
The detect-cache package is a Node.js library designed to help developers manage and detect caching in their applications.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
You should immediately uninstall the detect-cache package and rotate any sensitive information stored on the affected system.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
