Malicious Code Detected in eslint-config-compact-utils: Exfiltration of Host Data
Summary
MAL-2026-16417: Malicious code in eslint-config-compact-utils (npm). Affects eslint-config-compact-utils versions 1.0.0 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint-config-compact-utils is an npm package designed to provide a set of ESLint configuration utilities for developers. It aims to simplify the process of setting up ESLint in JavaScript projects. However, a recent vulnerability has been identified that compromises its integrity, allowing malicious code to execute upon import, leading to potential data exfiltration.
Vulnerability Detail
The vulnerability originates from the package's index.js file, which collects sensitive host information such as the hostname, username, platform, architecture, Node version, and current working directory. It also gathers CI/repository environment variables and sends this data to a hardcoded endpoint via an HTTP GET request. This behavior is executed automatically when the module is imported, making it a significant security risk as it operates outside the intended functionality of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eslint-config-compact-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the eslint-config-compact-utils package altogether and rely on other ESLint configurations that are known to be secure. Additionally, you can monitor your application for vulnerabilities using tools like Vulert, which can alert you to any open-source vulnerabilities in your software.
Conclusion
The eslint-config-compact-utils package has been identified as malicious due to its ability to exfiltrate sensitive data upon import. It is crucial for developers to remove this package from their projects and monitor for vulnerabilities using tools like Vulert to ensure the security of their applications.
See every vulnerability recorded for eslint-config-compact-utils →
FAQ
eslint-config-compact-utils is an npm package that provides a set of utilities for configuring ESLint in JavaScript projects.
The vulnerability allows the package to exfiltrate sensitive host information and CI environment variables to a remote server upon import.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
No patch is available for eslint-config-compact-utils; it is recommended to remove the package from your project.
You should uninstall the package immediately and consider using alternative ESLint configurations that do not have known vulnerabilities.
