Malicious Code Detected in fdir4 Package: Version 99.99.2 Compromised
Summary
MAL-2025-192355: Malicious code in fdir4 (npm). Affects fdir4 versions 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fdir4 package is a Node.js library designed for directory traversal and file manipulation tasks. It is widely used in various applications for its efficiency in handling file systems. However, the package version 99.99.2 has been identified as malicious, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability stems from the fdir4 package communicating with a domain linked to malicious activities. Additionally, it executes commands that are associated with harmful behavior, potentially compromising the security of systems that utilize this package. Users of this version may face data breaches, unauthorized access, and other security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fdir4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the fdir4 package version 99.99.2. Instead, consider using an alternative package for directory manipulation or revert to a previous, secure version of fdir4 until a patch is confirmed.
Conclusion
The fdir4 package version 99.99.2 has been identified as malicious, posing serious security risks. Users are advised to update to the latest version or find alternatives to mitigate potential threats. Regular monitoring and vulnerability checks are essential for maintaining application security.
See every vulnerability recorded for fdir4 →
FAQ
fdir4 is a Node.js library used for directory traversal and file manipulation tasks.
The OpenSSF Package Analysis project flagged fdir4 version 99.99.2 due to its communication with a malicious domain and execution of harmful commands.
Using the compromised version can lead to data breaches, unauthorized access, and potential exploitation of your application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider using an alternative package or reverting to a previous secure version until a patch is available.
