Malicious Code Vulnerability in eslint-config-compact-base: Host Data Exfiltration
Summary
MAL-2026-17157: Malicious code in eslint-config-compact-base (npm). Affects eslint-config-compact-base versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint-config-compact-base is an npm package designed to provide a compact configuration for ESLint, a popular tool for identifying and fixing problems in JavaScript code. This package is intended to streamline the linting process for developers by offering a set of predefined rules. However, it has been found to contain malicious code that compromises the security of systems using it.
Vulnerability Detail
The vulnerability originates from the index.js file of the eslint-config-compact-base package, which executes upon module load. It collects sensitive host reconnaissance data, including the operating system platform, hostname, username, architecture, Node.js version, and current working directory. Additionally, it gathers CI-context environment variables such as CI, RUNNER_NAME, and GITHUB_REPOSITORY. This information is serialized and sent to a hardcoded endpoint controlled by an attacker, allowing for unauthorized data exfiltration. The behavior is triggered unconditionally on require(), making any build, install, or CI job that includes this ESLint config susceptible to leaking sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eslint-config-compact-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the eslint-config-compact-base package in your project. Instead, consider using a different ESLint configuration package that does not have known vulnerabilities. You can also manually review your package-lock.json file to ensure that no malicious packages are included.
Conclusion
The eslint-config-compact-base package contains a serious vulnerability that allows for the exfiltration of sensitive host data. It is essential for developers to remove this package from their projects and replace it with a secure alternative to protect their systems from potential attacks.
See every vulnerability recorded for eslint-config-compact-base →
FAQ
eslint-config-compact-base is an npm package that provides a compact configuration for ESLint, aimed at simplifying the linting process for JavaScript developers.
The vulnerability allows malicious code to collect sensitive information from your host system and send it to an attacker-controlled endpoint, potentially compromising your project's security.
Currently, there is no patched version of eslint-config-compact-base available. It is advised to uninstall the package and use a secure alternative.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using your package-lock.json file, you can check if your application is affected by this vulnerability without needing to install any software.
If you have already used eslint-config-compact-base, it is crucial to uninstall it immediately and replace it with a secure alternative. Review your project for any potential data leaks.
