Malicious Code Detected in elf-stats-ginger-wreath-646: A Critical npm Vulnerability
Summary
MAL-2025-192303: Malicious code in elf-stats-ginger-wreath-646 (npm). Affects elf-stats-ginger-wreath-646 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'elf-stats-ginger-wreath-646' is an npm package that is intended for use in JavaScript applications. It is designed to provide certain functionalities, but has been flagged for malicious behavior. This package, at version 1.0.0, has been identified as a security risk due to its communication with domains linked to malicious activities and its ability to execute harmful commands.
Vulnerability Detail
The vulnerability in 'elf-stats-ginger-wreath-646' stems from its malicious nature, which includes communicating with a domain associated with harmful activities and executing commands that can compromise system integrity. This poses significant risks, including data theft, unauthorized access, and potential system damage. The vulnerability was identified by the OpenSSF Package Analysis project, which flagged the package based on its behavior and interactions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall elf-stats-ginger-wreath-646If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily disable any functionalities that rely on 'elf-stats-ginger-wreath-646' until you can fully remove it from your project. This can be done by commenting out any import statements or code that utilizes this package.
Conclusion
The 'elf-stats-ginger-wreath-646' package poses a significant security risk due to its malicious behavior. It is crucial for developers to remove this package from their projects and monitor for any potential vulnerabilities using tools like Vulert. By staying informed and proactive, you can protect your applications from such threats.
See every vulnerability recorded for elf-stats-ginger-wreath-646 →
FAQ
It is an npm package that has been identified as malicious due to its harmful behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the package immediately using the command 'npm uninstall elf-stats-ginger-wreath-646' and look for safer alternatives.
The risks include data theft, unauthorized access to your system, and potential damage to your application.
No patch is available for 'elf-stats-ginger-wreath-646' as it is recommended to remove the package entirely.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
