Critical Malicious Code Vulnerability in firestore-types Package
Summary
MAL-2026-219: Malicious code in firestore-types (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The firestore-types package is an npm library designed to provide type definitions for Firestore, a NoSQL database service from Google. It is widely used in JavaScript and TypeScript projects to enhance type safety and improve development efficiency. However, this package has been compromised, leading to significant security risks for any application that utilizes it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the firestore-types package. This code can fully compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it contains embedded malicious code. Users are advised to treat any system with this package as potentially compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall firestore-typesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily replace the firestore-types package with an alternative library that provides similar functionality without the associated risks. However, ensure that you thoroughly vet any alternative package for security vulnerabilities before use.
Conclusion
The firestore-types package has been identified as containing malicious code that poses a significant security risk. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for firestore-types →
FAQ
You should immediately uninstall the firestore-types package and rotate any sensitive information stored on the affected system.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. By simply analyzing your package-lock.json file, Vulert can provide real-time alerts about vulnerabilities in your software.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities. Additionally, consider using only well-maintained packages from reputable sources.
Failure to address this vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and complete compromise of the affected system.
It is recommended to avoid using firestore-types until a secure version is released. Consider using alternative libraries that provide similar functionality.
