Malicious Code Detected in elf-stats Package - npm Vulnerability
Summary
MAL-2025-192469: Malicious code in elf-stats (npm). Affects elf-stats versions 99.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elf-stats package is a Node.js library designed to provide statistics and information about ELF (Executable and Linkable Format) files. It is commonly used in various applications that require analysis of binary files. However, this package has been compromised, leading to the introduction of malicious code that can potentially harm users and their systems.
Vulnerability Detail
The vulnerability in the elf-stats package stems from the presence of malicious code that was identified by Amazon Inspector. This code can lead to unauthorized access, data breaches, or system compromise. The malicious code was found in version 99.9.9 of the package, and it poses significant risks to any application utilizing this version. Users are advised to take immediate action to mitigate these risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall elf-statsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the elf-stats package from their project until a secure version is confirmed. This can be done using the command: npm uninstall elf-stats.
Conclusion
The elf-stats package has been compromised with malicious code, posing significant risks to users. It is crucial to update to a secure version or remove the package until a fix is available. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for elf-stats →
FAQ
The elf-stats package is a Node.js library that provides statistics and information about ELF files, commonly used in applications that analyze binary files.
The malicious code was detected by Amazon Inspector, a security tool that scans for vulnerabilities in software packages.
The risks include unauthorized access to systems, data breaches, and potential compromise of user applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider removing the elf-stats package from your project as a temporary measure until a secure version is available.
