Critical Malicious Code Vulnerability in jsonify-errors Package
Summary
MAL-2025-192384: Malicious code in jsonify-errors (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsonify-errors package is an npm library designed to facilitate the formatting of error messages in JSON format, making it easier for developers to handle errors in web applications. However, this package has been compromised, leading to significant security concerns. The malicious code embedded within it can potentially grant unauthorized access to systems where the package is installed, making it a serious threat to application security.
Vulnerability Detail
The vulnerability originates from the presence of malicious code within the jsonify-errors package. This code can fully compromise any computer that has the package installed or running, allowing attackers to gain control over the system. The ramifications include unauthorized access to sensitive information, such as secrets and keys, which could lead to further exploitation of the affected system. The vulnerability is classified under CWE-506, indicating that it contains embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jsonify-errorsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily disable the functionality that relies on the jsonify-errors package until it is removed or replaced with a secure alternative. Ensure that your application does not process any error messages using this package during this period.
Conclusion
The jsonify-errors package has been identified as containing malicious code that poses a significant security risk. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
See every vulnerability recorded for jsonify-errors →
FAQ
You should immediately remove the jsonify-errors package from your system and rotate any sensitive information stored on that machine.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
Failing to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential exploitation of sensitive information.
It is advisable to find an alternative package or implement your own error handling mechanism, as the jsonify-errors package is compromised.
