Critical Malicious Code Vulnerability in json-specular Package
Summary
MAL-2026-1978: Malicious code in json-specular (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-specular package is an npm library designed for handling JSON specifications. It is commonly used in various applications for data interchange and API interactions. However, this package has been identified as containing malicious code, which poses a significant security risk to any system utilizing it. Users of this package should be aware of its potential to compromise sensitive information and system integrity.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the json-specular package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive data such as secrets and keys. The malicious nature of this code means that even after removal of the package, there is no guarantee that all traces of the malicious software will be eliminated, potentially leaving the system vulnerable to further attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall json-specularIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the only effective workaround is to uninstall the json-specular package and rotate any sensitive credentials that may have been compromised. Use the command: 'npm uninstall json-specular'.
Conclusion
The json-specular package has been identified as containing malicious code that poses a serious security threat. Users are advised to uninstall the package immediately and take necessary precautions to secure their systems. Continuous monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for json-specular →
FAQ
json-specular is an npm package used for managing JSON specifications in applications.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to further attacks.
You should immediately uninstall the package and rotate any sensitive credentials stored on the affected system.
Currently, there is no patched version available for the json-specular package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
