Critical Malicious Code Vulnerability in fdir3 Package
Summary
MAL-2026-1734: Malicious code in fdir3 (npm). Affects fdir3 versions 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fdir3 package is a popular Node.js library used for directory traversal and file manipulation tasks. It provides developers with an efficient way to handle file system operations, making it a valuable tool in various applications. However, this package has been identified to contain malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability in the fdir3 package arises from the presence of malicious code that can execute harmful actions on the user's system. This code was introduced in version 99.99.1 of the package and can lead to unauthorized access, data breaches, or system compromise. The malicious code was reported by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fdir3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider temporarily removing the fdir3 package from your project until a secure version is confirmed. You can do this by executing 'npm uninstall fdir3' in your terminal.
Conclusion
The fdir3 package has been identified to contain malicious code, posing significant security risks. Users are advised to update to the latest version to mitigate these risks. Regular monitoring of open-source dependencies is crucial for maintaining application security.
See every vulnerability recorded for fdir3 →
FAQ
The fdir3 package is used for directory traversal and file manipulation in Node.js applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Using the compromised fdir3 package can lead to unauthorized access to your system, data breaches, and potential system compromise.
The vulnerability was reported by ReversingLabs, a security research firm specializing in malware analysis.
Yes, updating to the latest version of the fdir3 package will resolve the vulnerability.
