Malicious Code Detected in devlino Package: Security Alert
Summary
MAL-2026-1421: Malicious code in devlino (npm). Affects devlino versions 1.0.1 – 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'devlino' package, available on npm, is designed for developers to streamline certain tasks within their applications. However, it has been flagged for containing malicious code that communicates with a domain linked to harmful activities. This raises significant security concerns for users who may unknowingly integrate this package into their projects.
Vulnerability Detail
The vulnerability in the 'devlino' package arises from its version 1.0.1, which has been identified as malicious by the OpenSSF Package Analysis project. The package's malicious behavior includes communicating with a domain associated with malicious activities, potentially compromising the security of applications that utilize it. This can lead to data breaches, unauthorized access, and other security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall devlinoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the 'devlino' package from their project until a secure version is confirmed. This can be done using the command: npm uninstall devlino.
Conclusion
The 'devlino' package has been identified as malicious, posing significant security risks to applications that utilize it. Users are advised to uninstall the package and update to a secure version as soon as possible. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for devlino →
FAQ
The 'devlino' package is an npm package used by developers for various tasks in their applications, but it has been flagged for malicious behavior.
You can check if your application is affected by using the Vulert platform, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
If you have installed 'devlino', it is crucial to uninstall it immediately and update to a secure version if available.
Using a malicious package can lead to severe security risks, including data breaches, unauthorized access to sensitive information, and potential damage to your application.
To prevent future vulnerabilities, regularly monitor your dependencies using tools like Vulert, and always review package sources and their reputations before installation.
