Malicious Code Detected in fdir5 Package: Version 99.99.2 Compromised
Summary
MAL-2025-192356: Malicious code in fdir5 (npm). Affects fdir5 versions 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fdir5 package is a Node.js library designed for directory manipulation and file operations. It is widely used in various applications for its ability to efficiently handle file system tasks. However, the version 99.99.2 of this package has been identified as malicious, posing serious security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the fdir5 package arises from its communication with a domain linked to malicious activities and the execution of commands that can lead to harmful behavior. This can result in unauthorized access to sensitive data, system compromise, and potential exploitation of the host environment. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which flagged it due to its suspicious operations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fdir5If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the fdir5 package from your project until a secure version is confirmed. Use the following command to uninstall it: npm uninstall fdir5. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The fdir5 package version 99.99.2 has been flagged as malicious due to its harmful behavior and communication with malicious domains. It is crucial for developers to update or remove this package to safeguard their applications from potential threats.
See every vulnerability recorded for fdir5 →
FAQ
The fdir5 package is used for directory manipulation and file operations in Node.js applications.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If an immediate update is not possible, consider removing the package and using alternative libraries until a secure version is available.
Using the compromised version can lead to unauthorized access, data breaches, and potential exploitation of your system.
The malicious nature of the fdir5 package was identified by the OpenSSF Package Analysis project.
