Critical Malicious Code Vulnerability in flatten-unflatten Package
Summary
MAL-2025-191095: Malicious code in flatten-unflatten (npm). Affects flatten-unflatten versions 1.0.1 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The flatten-unflatten package is an npm library designed to simplify the process of flattening and unflattening objects in JavaScript. It is commonly used in applications that require data transformation and manipulation. However, this package has been identified as containing malicious code, posing a significant security risk to any system that has it installed.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the flatten-unflatten package. This code can compromise the entire system, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code has been confirmed by security researchers, and any system running this package should be considered fully compromised. Users are advised to take immediate action to mitigate the risks associated with this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall flatten-unflattenIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to avoid using the flatten-unflatten package altogether. Instead, consider using alternative libraries that provide similar functionality without the associated risks. Always review the security status of any package before installation.
Conclusion
The flatten-unflatten package has been identified as containing malicious code, posing a severe risk to any system that utilizes it. Immediate action is required to uninstall the package and secure any compromised information. Users are encouraged to explore alternative libraries and utilize monitoring tools like Vulert to maintain application security.
See every vulnerability recorded for flatten-unflatten →
FAQ
Immediately uninstall the package using 'npm uninstall flatten-unflatten' and rotate any sensitive information that may have been compromised.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and complete system compromise.
Currently, there is no patched version available. The best course of action is to uninstall the package.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and always keep your packages updated to their latest versions.
