Malicious Code Detected in deuro-landing-page Package - Version 5.9.9
Summary
MAL-2026-733: Malicious code in deuro-landing-page (npm). Affects deuro-landing-page versions 5.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'deuro-landing-page' package is an npm module designed for creating landing pages. It is utilized by developers to streamline the process of building web interfaces. However, version 5.9.9 has been flagged for containing malicious code that compromises user security and system integrity.
Vulnerability Detail
The vulnerability in the 'deuro-landing-page' package arises from its communication with a domain linked to malicious activities. Additionally, it executes commands that can lead to harmful behavior, potentially allowing attackers to gain unauthorized access or control over affected systems. This poses significant risks to users and their data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall deuro-landing-pageIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the 'deuro-landing-page' package altogether until a secure version is confirmed. If you must use it, consider isolating it in a controlled environment to minimize potential risks.
Conclusion
The 'deuro-landing-page' package version 5.9.9 has been identified as malicious, posing serious risks to users. It is essential to update to a secure version or implement workarounds to mitigate potential threats. Regular monitoring with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for deuro-landing-page →
FAQ
The 'deuro-landing-page' package is an npm module used for creating landing pages in web applications.
Version 5.9.9 is considered malicious due to its communication with a harmful domain and execution of commands associated with malicious behavior.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider isolating the package in a controlled environment to reduce exposure to potential threats.
Detailed information about this vulnerability can be found in the OpenSSF Package Analysis project documentation and the package's repository.
