Malicious Code Detected in dhgshop Package - Version 9.0.10
Summary
MAL-2026-605: Malicious code in dhgshop (npm). Affects dhgshop versions 9.0.10 – 9.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'dhgshop' package is a Node.js library available on npm, designed for e-commerce functionalities. It allows developers to integrate shopping cart features into their applications. However, version 9.0.10 has been flagged for malicious behavior, raising concerns about its security and integrity.
Vulnerability Detail
The vulnerability in the 'dhgshop' package arises from its communication with a domain linked to malicious activities and the execution of commands that could compromise user systems. This behavior poses significant risks, including data theft, unauthorized access, and potential system damage. The OpenSSF Package Analysis project identified this issue, emphasizing the need for immediate attention.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dhgshopIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the 'dhgshop' package from your project until a secure version is confirmed. You can uninstall it using the command: npm uninstall dhgshop.
Conclusion
The 'dhgshop' package version 9.0.10 has been identified as malicious, posing significant risks to applications that utilize it. Immediate action is required to update or remove the package to safeguard your systems. Utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for dhgshop →
FAQ
The package communicates with a domain associated with malicious activities and executes harmful commands.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Consider removing the package from your project as a temporary measure until a secure version is available.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, which alerts you in real-time for open-source vulnerabilities.
Yes, using tools like Vulert, which can monitor your package-lock.json file to alert you about vulnerabilities automatically.
