Malicious Code Vulnerability in hachutis Package
Summary
MAL-2026-16464: Malicious code in hachutis (npm). Affects hachutis versions 1.0.0 – 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hachutis package is an npm library designed for specific functionalities related to environment management and execution of commands. However, it has been found to contain malicious code that compromises user systems. This vulnerability arises from the inclusion of undeclared prebuilt executables that are not documented in the package's manifest, leading to potential exploitation.
Vulnerability Detail
The hachutis package contains malicious code embedded within its binaries. The tarball includes three undeclared executables that are not referenced in the package.json file. The main script points to a non-existent file, while the actual functionality is hidden within the binaries. Running these binaries establishes a connection to an attacker-controlled server, allowing for unauthorized access and potential data breaches. This vulnerability is classified under CWE-506, indicating the presence of embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hachutisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid executing any binaries included in the hachutis package. Instead, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The hachutis package has been identified as containing malicious code that poses significant security risks. Users are advised to update or remove the package to safeguard their systems. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for hachutis →
FAQ
The hachutis package is an npm library used for environment management and command execution, but it has been compromised with malicious code.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If you have installed hachutis, it is crucial to update the package to the latest version or remove it entirely to prevent exploitation.
The risks include unauthorized access to your system, potential data breaches, and the execution of malicious commands without your consent.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file.
