Malicious Code Detected in jslint-config Package: Version 10.22.2
Summary
MAL-2026-1055: Malicious code in jslint-config (npm). Affects jslint-config versions 10.22.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jslint-config package is a configuration tool for JSLint, a JavaScript code quality tool that helps developers identify potential issues in their code. This package is commonly used in JavaScript projects to enforce coding standards and improve code quality. However, the specific version 10.22.2 has been identified as malicious, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability in jslint-config arises from its malicious behavior, which includes communicating with a domain linked to harmful activities and executing commands that can compromise system integrity. This behavior can lead to unauthorized access, data breaches, and potential exploitation of the affected systems. The origin of this vulnerability has been traced back to the OpenSSF Package Analysis project, which flagged this version as malicious due to its suspicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jslint-configIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the jslint-config package from your project until a secure version is confirmed. Use the following command to uninstall the package: npm uninstall jslint-config.
Conclusion
The jslint-config package version 10.22.2 has been identified as malicious, posing significant risks to users. It is crucial to update or remove the package to protect your applications from potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for jslint-config →
FAQ
jslint-config is a configuration package for JSLint, which helps enforce coding standards in JavaScript projects.
This version has been flagged for communicating with a malicious domain and executing harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
As a temporary measure, you can uninstall the jslint-config package to mitigate risks until a secure version is available.
Vulert uses the package-lock.json file to monitor and alert for vulnerabilities in open-source software, providing real-time insights.
