Remote Code Execution Vulnerability in insomnia-plugin-api-lint-helper
Summary
MAL-2026-17561: Malicious code in insomnia-plugin-api-lint-helper (npm). Affects insomnia-plugin-api-lint-helper versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The insomnia-plugin-api-lint-helper is an npm package designed to assist developers using Insomnia, a popular REST client for testing APIs. This package aims to enhance the functionality of Insomnia by providing linting capabilities for API requests. However, it has been found to contain a critical vulnerability that allows for arbitrary code execution, posing a significant risk to users' systems.
Vulnerability Detail
The vulnerability originates from the package's main entry file, index.js, which executes malicious code upon loading. It spawns OS-native calculator processes, writes a marker file to the user's Desktop, and exposes sensitive environment variables to the console. This behavior indicates a proof-of-concept remote code execution payload targeting Insomnia's plugin loader, allowing attackers to execute arbitrary commands and access sensitive information without user interaction.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall insomnia-plugin-api-lint-helperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the affected package from their project by executing the following command: npm uninstall insomnia-plugin-api-lint-helper. This will prevent the execution of the malicious code until a patched version is available.
Conclusion
The insomnia-plugin-api-lint-helper package contains a severe vulnerability that allows for remote code execution. Users are advised to update or uninstall the package to protect their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for insomnia-plugin-api-lint-helper →
FAQ
The vulnerability allows for remote code execution, enabling attackers to run arbitrary commands on the user's system without interaction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can uninstall the package to mitigate the risk of exploitation until a patch is available.
Detailed information about the vulnerability can be found in the vulnerability report and the package's repository on npm.
Regularly updating dependencies, using tools like Vulert for monitoring, and conducting security audits can help prevent similar vulnerabilities.
