Malicious Code Injection in galaxyguide Package: npm Vulnerability Overview
Summary
MAL-2025-171248: Malicious code in galaxyguide (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The galaxyguide package is part of the npm ecosystem, which is widely used for JavaScript package management. It is designed to facilitate various functionalities within applications by providing reusable code modules. However, this package has been identified as part of a malicious campaign that targets developers by manipulating package metadata and flooding the npm registry with derivative packages.
Vulnerability Detail
The vulnerability in the galaxyguide package originates from its association with a malicious token reward campaign. This campaign involves the use of scripts that automatically generate and publish derivative packages with randomized names. The malicious payload alters the package.json file by removing private flags, changing version numbers, and continuously republishing variants to pollute the npm registry. This can lead to reputational damage for developers and potential security risks for applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall galaxyguideIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the galaxyguide package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your package-lock.json file for any unexpected changes using tools like Vulert.
Conclusion
The galaxyguide package has been identified as a vector for malicious code injection, posing significant risks to applications that utilize it. Developers are advised to uninstall this package and monitor their dependencies closely. Utilizing tools like Vulert can help in maintaining the security of your applications.
See every vulnerability recorded for galaxyguide →
FAQ
The galaxyguide package is an npm package used for various functionalities in JavaScript applications, but it has been compromised with malicious code.
The vulnerability can lead to the injection of malicious code into your application, potentially compromising security and functionality.
You should uninstall the galaxyguide package immediately and check for any dependencies that may be affected.
Yes, tools like Vulert can monitor your package-lock.json file for vulnerabilities in real-time without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
