Malicious Code Detected in eslint-config-skynet: A Critical Vulnerability
Summary
MAL-2026-15: Malicious code in eslint-config-skynet (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint-config-skynet is an npm package that provides a set of configuration rules for ESLint, a popular JavaScript linter. This package is designed to help developers maintain code quality by enforcing coding standards and identifying potential errors in JavaScript code. However, it has been found to contain malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the discovery of malicious code within the eslint-config-skynet package. This code can potentially compromise the security of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. The specific technical aspects of the malicious code have not been disclosed, but its presence in the package indicates a severe threat to users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eslint-config-skynetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using eslint-config-skynet and switch to a different ESLint configuration package that does not have known vulnerabilities. Additionally, you can manually configure ESLint rules in your project to maintain code quality without relying on this specific package.
Conclusion
The discovery of malicious code in the eslint-config-skynet package poses a serious threat to applications that utilize it. It is essential for developers to take immediate action by uninstalling the affected package and considering alternatives. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for eslint-config-skynet →
FAQ
eslint-config-skynet is an npm package that provides a set of ESLint configuration rules to help developers maintain code quality in JavaScript applications.
The exact functionality of the malicious code has not been disclosed, but it poses a significant security risk, potentially leading to unauthorized access or data breaches.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
Yes, Vulert offers real-time monitoring for open-source vulnerabilities without requiring code access or installation. You can use the Vulert playground to check your application for vulnerabilities.
If no patched version is available, consider using an alternative ESLint configuration package or manually configuring ESLint rules to ensure code quality without relying on the affected package.
