Critical Malicious Code Vulnerability in enforce-branch-name Package
Summary
MAL-2025-190959: Malicious code in enforce-branch-name (npm). Affects enforce-branch-name versions 1.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The enforce-branch-name package is an npm module designed to enforce branch naming conventions in version control systems. It is commonly used in software development workflows to maintain consistency and clarity in branch names. However, this package has been compromised, containing malicious code that poses significant security risks to any system where it is installed.
Vulnerability Detail
The vulnerability originates from the discovery of malicious code embedded within the enforce-branch-name package. This code can compromise the entire system, allowing unauthorized access to sensitive information such as secrets and keys. The implications of this vulnerability are severe, as any computer running this package should be considered fully compromised. Users are advised to take immediate action to mitigate potential damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall enforce-branch-nameIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that you rotate all secrets and keys stored on the compromised system from a different, secure computer. Additionally, monitor your system for any unusual activity that may indicate ongoing malicious actions.
Conclusion
The enforce-branch-name package has been identified as containing malicious code that compromises system security. Users must take immediate action to remove the package and secure their systems. Regular monitoring and auditing of dependencies are essential to prevent similar vulnerabilities in the future.
See every vulnerability recorded for enforce-branch-name →
FAQ
The enforce-branch-name package is an npm module used to enforce naming conventions for branches in version control systems, helping maintain consistency in development workflows.
If you have the enforce-branch-name package installed, your system may be compromised. Use tools like Vulert to check for vulnerabilities in your package-lock.json file.
Immediately remove the enforce-branch-name package and rotate any sensitive information stored on the affected system. Monitor for any signs of unauthorized access.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
