Critical Malicious Code Vulnerability in json-bundling Package
Summary
MAL-2026-1977: Malicious code in json-bundling (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-bundling package is a tool used in the npm ecosystem for bundling JSON files, allowing developers to manage and optimize their JSON data efficiently. However, this package has been found to contain malicious code that compromises the security of any system where it is installed. The vulnerability stems from the inclusion of embedded malicious code that can lead to unauthorized access and control over the affected systems.
Vulnerability Detail
The vulnerability identified in the json-bundling package is classified as embedded malicious code. This issue originates from a malicious actor who has injected harmful code into the package, which can fully compromise any computer running it. The ramifications are severe, as all secrets and keys stored on the compromised computer may be exposed. Users are advised to treat any system with this package installed as fully compromised, and there is no guarantee that simply removing the package will eliminate all traces of the malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall json-bundlingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily disable the usage of the json-bundling package in your project until the vulnerability is resolved. This can be done by removing it from your package.json dependencies and running npm install to update your project.
Conclusion
The json-bundling package has been identified as containing malicious code that poses a significant security risk. Users must act swiftly to remove the package and secure their systems by rotating any sensitive information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for json-bundling →
FAQ
The json-bundling package is a tool in the npm ecosystem designed for bundling JSON files, helping developers manage their JSON data more effectively.
The malicious code can fully compromise your system, allowing unauthorized access to sensitive information such as secrets and keys stored on the computer.
You should immediately remove the json-bundling package from your system and rotate any secrets or keys stored on the affected computer.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
While removing the package is essential, there is no guarantee that all malicious software will be removed. It is crucial to rotate all sensitive information stored on the compromised system.
