Critical Malicious Code Vulnerability in https-emailjs Package
Summary
MAL-2026-724: Malicious code in https-emailjs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The https-emailjs package is a Node.js library designed for sending emails using various email services. It simplifies the process of integrating email functionalities into applications. However, it has been found to contain malicious code that compromises the security of any system where it is installed.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the https-emailjs package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it embeds harmful functionalities within the software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall https-emailjsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily switch to an alternative email library that does not have known vulnerabilities until the https-emailjs package is confirmed safe or patched. Consider using libraries such as nodemailer or emailjs.
Conclusion
The discovery of malicious code in the https-emailjs package poses a significant risk to users. Immediate action is required to remove the package and secure any compromised information. Staying informed about vulnerabilities and using monitoring tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for https-emailjs →
FAQ
Immediately remove the package from your system and rotate any sensitive information that may have been compromised.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Keeping the package can lead to unauthorized access to your system, potentially allowing attackers to steal sensitive information or take control of your computer.
The best mitigation is to remove the package entirely and use a different email library until a safe version is released.
Utilize tools like Vulert to monitor your dependencies for vulnerabilities in real-time.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.