Malicious Code Injection in juris-qass-urs Package - npm Vulnerability
Summary
MAL-2025-157122: Malicious code in juris-qass-urs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The juris-qass-urs package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is designed to facilitate the development and deployment of JavaScript applications. However, it has been identified as part of a malicious campaign that exploits npm's publishing mechanisms, leading to significant security risks for developers and users alike.
Vulnerability Detail
The vulnerability stems from the malicious code embedded within the juris-qass-urs package, which is linked to a broader campaign aimed at inflating developer reputation scores for token rewards. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior not only compromises the integrity of the affected package but also pollutes the npm registry with numerous derivative packages, making it difficult for developers to trust the ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall juris-qass-ursIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the juris-qass-urs package altogether until a secure version is released. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The juris-qass-urs package has been identified as a vector for malicious code injection, posing significant risks to developers and users. Immediate action is required to mitigate these risks by uninstalling the package and monitoring for vulnerabilities using tools like Vulert. Staying informed and proactive is essential for maintaining the security of your applications.
See every vulnerability recorded for juris-qass-urs →
FAQ
The juris-qass-urs package is a JavaScript package available on npm, primarily used for developing applications. However, it has been compromised with malicious code.
The vulnerability can lead to the injection of malicious code into your application, potentially compromising its security and integrity.
You should immediately uninstall the juris-qass-urs package and monitor your application for any unusual behavior.
Regularly audit your dependencies, use tools like Vulert for real-time vulnerability monitoring, and stay updated on security advisories for the packages you use.
Yes, you can use Vulert's online playground to check your package-lock.json for vulnerabilities without requiring any installation.
