Critical Malicious Code Vulnerability in httpness Package
Summary
MAL-2025-190966: Malicious code in httpness (npm). Affects httpness versions 1.0.2 – 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The httpness package is a Node.js library designed for handling HTTP requests and responses. It is commonly used in web applications to simplify the process of making HTTP calls. However, it has been found to contain malicious code that compromises the security of any system where it is installed. This vulnerability poses a significant risk to developers and organizations relying on this package for their applications.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the httpness package. This code can lead to full system compromise, allowing attackers to gain unauthorized access to sensitive information, including secrets and keys stored on the affected machine. The malicious nature of the code is classified under CWE-506, indicating that it embeds harmful functionality within the software. Users are advised to treat any system with this package installed as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall httpnessIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate removal of the package is not feasible, consider isolating the affected application from sensitive data and networks until the package can be safely removed. However, this is not a permanent solution and should only be a temporary measure.
Conclusion
The discovery of malicious code within the httpness package poses a serious threat to any system utilizing it. Immediate action is required to remove the package and secure any exposed secrets. Users are encouraged to stay vigilant and utilize tools like Vulert for ongoing monitoring of their applications.
See every vulnerability recorded for httpness →
FAQ
The httpness package is used for simplifying HTTP requests and responses in Node.js applications.
If you have the httpness package installed, your system is likely affected. You can use Vulert to monitor and alert for vulnerabilities in your software.
Immediately rotate all secrets and keys stored on the compromised system from a secure, unaffected machine.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failing to address this vulnerability can lead to unauthorized access to sensitive information, data breaches, and potential control over your system by malicious actors.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
