Malicious Code Injection in fs-commons: A Critical Vulnerability
Summary
MAL-2026-17301: Malicious code in fs-commons (npm). Affects fs-commons versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fs-commons is an npm package designed as a filesystem and data-helper library. It provides functionalities to manage and manipulate data related to file systems. However, this package has been identified to contain malicious code that can execute arbitrary commands on the host system, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the package's exported functions, getTransactions() and load_transaction_data(), which act as dynamic code loaders. The code obfuscates critical identifiers and retrieves the Function constructor through an indirect method, making static analysis difficult. When invoked, these functions read a sibling file, models.js, which disguises malicious payloads as product metadata. This allows an attacker to execute arbitrary code with full Node.js privileges, compromising the host system's security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fs-commonsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the fs-commons package from your project until a secure version is released. This can be done using the command: npm uninstall fs-commons. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The fs-commons package contains a critical vulnerability that allows for the execution of malicious code on the host system. It is essential to update the package or remove it from your project to protect against potential security threats. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for fs-commons →
FAQ
fs-commons is an npm package that serves as a filesystem and data-helper library, facilitating data management and manipulation.
The vulnerability allows attackers to execute arbitrary code on your system, potentially leading to data breaches or system compromise.
Check the npm repository for fs-commons to see if a patched version has been released. If so, update the package to mitigate the risk.
Consider removing the fs-commons package from your project and using alternative libraries until a secure version is available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json. You can also check your application against known vulnerabilities using the Vulert playground.
