Critical Malicious Code Vulnerability in ing-ideal-acquiring-shared Package
Summary
MAL-2025-191575: Malicious code in ing-ideal-acquiring-shared (npm). Affects ing-ideal-acquiring-shared versions 15.1.26. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ing-ideal-acquiring-shared package is a Node.js library designed for integrating Ideal payment methods in applications. It provides developers with a streamlined way to handle transactions securely. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from a malicious code injection within the ing-ideal-acquiring-shared package, specifically in version 15.1.26. This malicious code can lead to unauthorized access, data breaches, and potential exploitation of the application. The presence of such code compromises the integrity and security of any application that relies on this package, making it imperative for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ing-ideal-acquiring-sharedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the ing-ideal-acquiring-shared package from your project until a secure version is released. You can do this by running the command: npm uninstall ing-ideal-acquiring-shared. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The ing-ideal-acquiring-shared package has been identified with a critical vulnerability due to malicious code. It is crucial for developers to take immediate action by updating the package or removing it from their projects to ensure the security of their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for ing-ideal-acquiring-shared →
FAQ
The ing-ideal-acquiring-shared package is used for integrating Ideal payment methods in Node.js applications, facilitating secure transaction handling.
You can use Vulert to monitor and alert for open-source vulnerabilities in your application. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
The risks include unauthorized access to sensitive data, potential exploitation of the application, and overall compromise of application security.
Yes, it is recommended to update the ing-ideal-acquiring-shared package to the latest version to mitigate the risks associated with this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
