Critical Malicious Code Vulnerability in jan-browser Package
Summary
MAL-2025-190847: Malicious code in jan-browser (npm). Affects jan-browser versions 0.13.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jan-browser package, available through npm, is designed to facilitate web browsing functionalities in JavaScript applications. However, it has been identified as containing malicious code that compromises the security of any system where it is installed. This vulnerability poses a significant risk to users, as it can lead to unauthorized access and control over sensitive data.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the jan-browser package, specifically version 0.13.1. This code can fully compromise any computer that has the package installed, allowing attackers to gain control over the system. The ramifications include potential data breaches, unauthorized access to secrets and keys, and the installation of additional malicious software. The vulnerability is classified under CWE-506, indicating that the product contains embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jan-browserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Users should ensure that they do not run any applications that depend on jan-browser until it has been completely uninstalled.
Conclusion
The discovery of malicious code within the jan-browser package highlights the importance of vigilance in managing open-source dependencies. Users must act promptly to remove the affected package and secure their systems to prevent unauthorized access and data breaches.
See every vulnerability recorded for jan-browser →
FAQ
jan-browser is an npm package designed to provide web browsing capabilities in JavaScript applications.
The malicious code can give attackers full control over your computer, leading to potential data breaches and unauthorized access.
No, the only way to mitigate the risk is to uninstall the jan-browser package immediately.
You should rotate all secrets and keys stored on the affected computer from a different, secure machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
