Critical Malicious Code Vulnerability in devstart-cli Package

devstart-cli Updated 24 Nov 2025

Summary

24/11/2025

Disclosed on

CRITICAL

Severity

No i

Fix available

Critical

Severity

Not published

CVSS Score

MAL-2025-190768: Malicious code in devstart-cli (npm). Affects devstart-cli versions 1.0.6. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The devstart-cli package is a command-line interface tool designed for developers to streamline their project setup and management processes. It is part of the npm ecosystem, which is widely used for JavaScript package management. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on, making it a significant threat to users and their data.

Vulnerability Detail

The vulnerability originates from the inclusion of malicious code within the devstart-cli package, specifically version 1.0.6. This code can grant unauthorized access to the user's system, potentially leading to data theft, loss of sensitive information, and full system compromise. Users are advised to treat any system running this package as fully compromised, as the malicious code may persist even after the package is removed.

How To Fix

This package is malicious. Remove it and rotate any credentials it could have accessed.

npm uninstall devstart-cli

If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

Currently, there are no effective workarounds to mitigate the risks posed by this vulnerability other than removing the package and securing the system. Users should also monitor their systems for any unusual activity following the removal.

Conclusion

The devstart-cli package has been identified as containing malicious code that poses a serious security threat. Users must take immediate action to remove the package and secure their systems. Regular monitoring for vulnerabilities is essential to maintain the security of your applications.

See every vulnerability recorded for devstart-cli →