Critical Malicious Code Vulnerability in json-specparse Package
Summary
MAL-2026-1368: Malicious code in json-specparse (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-specparse package is a JavaScript library used for parsing JSON data in Node.js applications. It is designed to simplify the process of handling JSON structures, making it easier for developers to work with data interchange formats. However, this package has been found to contain malicious code, posing a significant security risk to any system that utilizes it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the json-specparse package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it contains embedded malicious code. The ramifications of this vulnerability are severe, as it can lead to full control of the affected system by an outside entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall json-specparseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to uninstall the json-specparse package and replace it with a secure alternative for JSON parsing. Use the following command to uninstall: npm uninstall json-specparse.
Conclusion
The json-specparse package contains a critical vulnerability due to embedded malicious code, posing a significant risk to any system that uses it. Immediate action is required to remove the package and secure sensitive information. Monitoring tools like Vulert can help keep your applications safe from future vulnerabilities.
See every vulnerability recorded for json-specparse →
FAQ
json-specparse is a JavaScript library for parsing JSON data in Node.js applications.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially granting full control to an outside entity.
You should immediately uninstall the json-specparse package and rotate any sensitive information stored on your system.
Currently, there is no patch available for the json-specparse package. It is recommended to uninstall it until a secure version is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
