Malicious Code Detected in elf-stats-rooftop-cocoa-966 Package
Summary
MAL-2025-192264: Malicious code in elf-stats-rooftop-cocoa-966 (npm). Affects elf-stats-rooftop-cocoa-966 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elf-stats-rooftop-cocoa-966 package is an npm module designed for specific functionalities within JavaScript applications. However, it has been identified as containing malicious code, posing a significant risk to users who integrate it into their projects. This vulnerability can lead to unauthorized access or manipulation of application data.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the elf-stats-rooftop-cocoa-966 package. This code can execute harmful actions without the user's consent, potentially compromising the integrity and security of applications that utilize this package. The malicious code was identified by Amazon Inspector, which flagged the package as a security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall elf-stats-rooftop-cocoa-966If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the elf-stats-rooftop-cocoa-966 package until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The elf-stats-rooftop-cocoa-966 package has been identified as containing malicious code, posing a serious threat to applications that utilize it. Users are advised to remove the package and monitor their dependencies for vulnerabilities. Tools like Vulert can assist in maintaining the security of your software.
See every vulnerability recorded for elf-stats-rooftop-cocoa-966 →
FAQ
It is an npm package used in JavaScript applications, but it has been flagged for containing malicious code.
You can use Vulert to monitor and alert for vulnerabilities in your application. Simply upload your package-lock.json file to check for any affected packages.
You should remove the elf-stats-rooftop-cocoa-966 package from your project immediately and check for any updates or patches.
Regularly monitor your dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Detailed information can be found in the vulnerability report from Amazon Inspector or by visiting the Vulert website.
