Malicious Code Injection in formatting-subtitles Package
Summary
MAL-2026-18184: Malicious code in formatting-subtitles (npm). Affects formatting-subtitles versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The formatting-subtitles package is an npm library designed to assist users in formatting subtitle files for various media formats. It aims to provide a simple interface for manipulating subtitle data. However, this package has been found to contain malicious code that can compromise user systems during installation.
Vulnerability Detail
The vulnerability originates from the preinstall script defined in the package.json file, which executes a shell script (prepare.js) that contains malicious commands. These commands are designed to send user data to an external server and download and execute arbitrary code from a GitHub Gist. This poses significant risks, including unauthorized data access and execution of untrusted code on the user's machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall formatting-subtitlesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the formatting-subtitles package until the vulnerability is resolved. Alternatively, you can manually remove the preinstall script from the package.json file if you need to use the package for development purposes.
Conclusion
The formatting-subtitles package contains a serious vulnerability that allows for malicious code execution during installation. Users are advised to update to the latest version or remove the package entirely until a fix is available. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for formatting-subtitles →
FAQ
The vulnerability involves malicious code execution during the installation process, which can lead to data exposure and unauthorized code execution.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If you have installed the formatting-subtitles package, it is recommended to uninstall it immediately and update to the latest version that addresses the vulnerability.
Yes, if the package is installed, the malicious code can execute during the installation process, potentially affecting your system regardless of active usage.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and ensure that you only install packages from trusted sources.
