Critical Malicious Code Vulnerability in just-toasty Package
Summary
MAL-2025-191115: Malicious code in just-toasty (npm). Affects just-toasty versions 1.7.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The just-toasty package is an npm library designed for creating and managing toasty notifications in web applications. It is widely used due to its simplicity and ease of integration. However, recent findings have revealed that this package contains malicious code that compromises the security of any system it is installed on, making it a significant threat to developers and users alike.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the just-toasty package. This code can grant unauthorized access to the system, allowing attackers to control the affected computer fully. As a result, any secrets or keys stored on the machine should be considered compromised. The malicious nature of this code has been confirmed by security researchers, and it poses a severe risk to users who have installed the affected version (1.7.1).
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall just-toastyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no workarounds available to mitigate the effects of this vulnerability other than uninstalling the package and rotating any compromised credentials.
Conclusion
The just-toasty package has been identified as containing malicious code that poses a significant security risk. Users are advised to uninstall the package immediately and take necessary precautions to secure their systems. Regular monitoring of dependencies is essential to prevent future vulnerabilities.
See every vulnerability recorded for just-toasty →
FAQ
You should uninstall the just-toasty package immediately and rotate any secrets or keys stored on your system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
No, there is currently no patched version of the just-toasty package available. The only solution is to uninstall it.
Leaving the just-toasty package installed can lead to unauthorized access to your system, potentially compromising sensitive information and allowing attackers to control your computer.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and ensure to keep your packages updated.
