Critical Malicious Code Vulnerability in dspmobile Package
Summary
MAL-2026-750: Malicious code in dspmobile (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dspmobile package is a Node.js library designed for mobile application development, providing various functionalities to streamline the development process. However, it has been identified as containing malicious code, which poses a significant security risk to systems utilizing this package. Users of dspmobile should be aware of its potential vulnerabilities and the implications of using compromised software.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the dspmobile package. This code can compromise any computer that has the package installed or running, leading to unauthorized access and control by external entities. The ramifications include the potential exposure of sensitive information, such as secrets and keys, which should be rotated immediately from a secure environment. The malicious nature of this code is classified under CWE-506, indicating that the product contains code that appears to be malicious.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dspmobileIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate removal of the package is not feasible, consider isolating the affected system from the network to prevent further unauthorized access until the package can be safely removed.
Conclusion
The dspmobile package has been identified as containing malicious code, posing serious security risks to any system that has it installed. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for dspmobile →
FAQ
dspmobile is a Node.js library used for mobile application development, offering various tools and functionalities to developers.
If you have the dspmobile package installed, your system is considered compromised. You can use Vulert to monitor and alert for vulnerabilities in your software.
Immediately rotate all secrets and keys from a different, secure computer to prevent unauthorized access.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any installation.
CWE-506 refers to a classification of vulnerabilities where the product contains code that appears to be malicious in nature, posing significant security risks.
