Malicious Code Vulnerability in imgbundle Package
Summary
MAL-2026-17330: Malicious code in imgbundle (npm). Affects imgbundle versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
imgbundle is an npm package that is purported to function as an image bundler. It is designed to facilitate the management and bundling of image assets within applications. However, the package has been found to contain malicious code that undermines its intended functionality, posing significant security risks to users and their systems.
Vulnerability Detail
The vulnerability originates from the package's index.js file, which does not perform any legitimate image bundling as advertised. Instead, it executes a top-level Immediately Invoked Function Expression (IIFE) that reads an AES-256-CBC-encrypted file from a sibling dependency, cdn-img-fetch. The file is decrypted using a hardcoded key derived from a specific SHA-256 hash, and the plaintext is written to the filesystem, effectively staging malicious content. This behavior is coordinated with the cdn-img-fetch package, which supplies the encrypted data, making it a coordinated dropper. The README description misleadingly suggests legitimate functionality that is not present in the code, highlighting the deceptive nature of this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall imgbundleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the imgbundle package from your project to prevent the execution of the malicious code. Use the following command to uninstall it: npm uninstall imgbundle. Additionally, consider using alternative packages that provide legitimate image bundling functionality.
Conclusion
The imgbundle package has been identified as containing malicious code that compromises its intended functionality. Users are advised to update or remove the package to mitigate potential security risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for imgbundle →
FAQ
The vulnerability involves the presence of malicious code that decrypts and stages attacker-controlled content on the filesystem.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring access to the code or installation.
If you cannot update the package, it is recommended to remove it from your project and look for alternative solutions that do not pose security risks.
Uninstalling imgbundle should not result in data loss, but ensure that you have backups of any important files or configurations before making changes.
Detailed information about the vulnerability can be found in the official security advisory and the package's repository on GitHub.
