Malicious Code Vulnerability in event-hunter Package
Summary
MAL-2026-16478: Malicious code in event-hunter (npm). Affects event-hunter versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The event-hunter package is an npm library designed for event handling and management in JavaScript applications. It is commonly used for simplifying event-driven programming. However, this package has been found to contain malicious code that compromises user security by sending sensitive information to an external server without consent.
Vulnerability Detail
The vulnerability originates from a postinstall hook that executes a script upon package installation. This script runs 'node index.js', which collects the internal hostname and a timestamp, encodes this data in base64, and sends it to a hardcoded external URL via an HTTPS GET request. This behavior is classified as a 'Dependency Confusion to RCE' proof-of-concept, posing significant risks as it exposes sensitive information to third parties without user consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall event-hunterIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the event-hunter package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The event-hunter package contains a serious vulnerability that allows malicious code to execute upon installation, compromising user data. It is essential to update the package to a secure version and consider alternative solutions until a fix is available. Monitoring tools like Vulert can help keep your application secure.
See every vulnerability recorded for event-hunter →
FAQ
The event-hunter package is an npm library used for managing events in JavaScript applications.
The vulnerability can expose sensitive information, such as your internal hostname, to an external server without your consent, potentially leading to further security issues.
Check the npm registry or the official repository for the event-hunter package to see if a patched version has been released.
As a temporary measure, avoid using the event-hunter package and consider alternative libraries that do not have this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
