Malicious Code Detected in en-thrift-internal Package - Version 2.99.9
Summary
MAL-2026-986: Malicious code in en-thrift-internal (npm). Affects en-thrift-internal versions 2.99.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'en-thrift-internal' package is a Node.js library used for internal communication and data serialization in applications. It is designed to facilitate efficient data exchange between services. However, version 2.99.9 has been flagged for malicious behavior, specifically for communicating with domains linked to harmful activities, raising significant security concerns for users relying on this package.
Vulnerability Detail
The vulnerability in the 'en-thrift-internal' package stems from its version 2.99.9, which has been identified as malicious by the OpenSSF Package Analysis project. This version is known to communicate with a domain associated with malicious activities, potentially leading to data breaches, unauthorized access, or other security incidents. Users of this package are at risk of their applications being compromised due to this malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall en-thrift-internalIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'en-thrift-internal' package from your project if it is not critical to your application's functionality. You can do this by executing: npm uninstall en-thrift-internal. Alternatively, consider using a different package that provides similar functionality without the associated risks.
Conclusion
The 'en-thrift-internal' package version 2.99.9 has been identified as malicious, posing significant security risks to applications that utilize it. Users are advised to update to a patched version or consider alternative packages. Regular monitoring and proactive security measures are essential to safeguard applications from such vulnerabilities.
See every vulnerability recorded for en-thrift-internal →
FAQ
The 'en-thrift-internal' package is a Node.js library used for internal communication and data serialization between services.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 2.99.9 for communicating with a domain linked to malicious activities.
Using the vulnerable version may expose your application to data breaches, unauthorized access, and other security threats due to its malicious communication.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
To prevent similar vulnerabilities, regularly update your dependencies, monitor for security advisories, and consider using tools like Vulert for real-time vulnerability alerts.
