Critical Malicious Code Vulnerability in jz-native-js-bridge Package
Summary
MAL-2025-192817: Malicious code in jz-native-js-bridge (npm). Affects jz-native-js-bridge versions 114.5.14. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jz-native-js-bridge package is a JavaScript library designed to facilitate communication between native mobile applications and JavaScript code. It is commonly used in hybrid mobile app development to bridge the gap between web technologies and native functionalities. However, this package has recently been identified as containing malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the jz-native-js-bridge package stems from the presence of malicious code that can compromise the security of applications using this library. This code can lead to unauthorized access, data breaches, and potential exploitation of user data. The malicious code was identified in version 114.5.14 of the package, and it is crucial for developers to understand the implications of using this compromised version in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jz-native-js-bridgeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the jz-native-js-bridge package from your project and replacing it with an alternative library that provides similar functionality without the associated risks.
Conclusion
The jz-native-js-bridge package has been found to contain malicious code, posing serious security risks to applications that utilize it. Developers are urged to update to a secure version or consider alternative libraries to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for jz-native-js-bridge →
FAQ
jz-native-js-bridge is a JavaScript library used for communication between native mobile applications and JavaScript code, primarily in hybrid app development.
The vulnerability involves malicious code within the jz-native-js-bridge package that can lead to unauthorized access and data breaches in applications using it.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider removing it from your project and using an alternative library until a secure version is available.
The vulnerability was identified by ReversingLabs, a cybersecurity firm specializing in threat detection and analysis.
