Critical Security Breach in drop-events-on-property-plugin: Malicious Code Detected
Summary
MAL-2025-191394: Malicious code in drop-events-on-property-plugin (npm). Affects drop-events-on-property-plugin versions 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drop-events-on-property-plugin is an npm package designed to facilitate event handling in JavaScript applications. It allows developers to manage events efficiently by providing a streamlined interface. However, this package has been compromised, making it susceptible to severe security threats that can affect users' systems and data integrity.
Vulnerability Detail
The vulnerability stems from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from users, subsequently publishing this sensitive information to GitHub. Additionally, it can propagate itself to other npm packages owned by the user and establish persistence through a GitHub action. The worm poses a significant risk as it may also lead to the destruction of the user's home directory, resulting in potential data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall drop-events-on-property-pluginIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the drop-events-on-property-plugin from your project by executing: npm uninstall drop-events-on-property-plugin. This will help mitigate the risk until a secure version is available.
Conclusion
The drop-events-on-property-plugin has been compromised by a malicious worm that poses serious security risks to users. It is essential to take immediate action by updating or removing the package to protect sensitive information and maintain system integrity. Regular monitoring and using tools like Vulert can help safeguard against such vulnerabilities in the future.
See every vulnerability recorded for drop-events-on-property-plugin →
FAQ
It is an npm package used for managing event handling in JavaScript applications.
The malicious code can steal sensitive tokens and credentials, potentially leading to unauthorized access to your accounts and data.
You should uninstall the package immediately and monitor your accounts for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
Removing the package will help mitigate the immediate risk, but you should also review your accounts for any unauthorized access and change your credentials.
