Critical Malicious Code Vulnerability in feed-widget-helper Package
Summary
MAL-2026-16332: Malicious code in feed-widget-helper (npm). Affects feed-widget-helper versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The feed-widget-helper package is an npm library designed to assist developers in integrating feed widgets into their applications. It is commonly used for displaying dynamic content from various sources. However, this package has been found to contain malicious code that compromises user privacy by leaking sensitive information.
Vulnerability Detail
The vulnerability originates from the package's main entry point, which executes a top-level side effect that reads the document.cookie and sends it to a hardcoded URL (http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa) over plain HTTP. This action occurs unconditionally upon loading the package, without any user consent or configuration, leading to the leakage of browser cookies to an anonymous third-party listener controlled by the package author. This poses a significant risk as it can expose sensitive user data to malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall feed-widget-helperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the feed-widget-helper package from your project until a secure version is released. You can do this by executing the following command: npm uninstall feed-widget-helper. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The feed-widget-helper package contains a critical vulnerability that exposes user cookies to a malicious third party. It is essential to update the package to a secure version or remove it from your project to protect user data. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for feed-widget-helper →
FAQ
The feed-widget-helper package is an npm library used for integrating feed widgets into web applications, allowing developers to display dynamic content.
The vulnerability allows the package to leak sensitive browser cookies to an unauthorized third party, potentially compromising user privacy and security.
Check the npm registry for the latest version of the feed-widget-helper package. If a patched version is available, update your package to that version.
As a temporary measure, consider uninstalling the package or using alternative libraries that do not have this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. It analyzes your package-lock.json file to provide real-time alerts. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
