Critical Malicious Code Vulnerability in jz-user-js-bridge Package
Summary
MAL-2025-192819: Malicious code in jz-user-js-bridge (npm). Affects jz-user-js-bridge versions 999.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jz-user-js-bridge package is a JavaScript library designed to facilitate communication between JavaScript and native code in mobile applications. It is commonly used in hybrid app development to bridge the gap between web technologies and native functionalities. However, this package has been identified with a serious vulnerability that allows malicious code execution, posing significant risks to applications that rely on it.
Vulnerability Detail
The vulnerability identified in the jz-user-js-bridge package stems from the inclusion of malicious code within version 999.0.0. This malicious code can potentially allow attackers to execute arbitrary commands, leading to unauthorized access, data breaches, or even complete system compromise. The origin of this vulnerability is linked to the package's distribution through npm, where it was found to be tampered with, making it critical for users to be aware of the risks associated with this specific version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jz-user-js-bridgeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the jz-user-js-bridge package from your project until a secure version is available. You can do this by running: npm uninstall jz-user-js-bridge. Additionally, monitor your application for any suspicious activity that may arise from the use of this package.
Conclusion
The jz-user-js-bridge package has been identified with a critical vulnerability due to the presence of malicious code in version 999.0.0. It is essential for developers using this package to update to a secure version promptly or implement workarounds to mitigate risks. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for jz-user-js-bridge →
FAQ
The jz-user-js-bridge package is used to enable communication between JavaScript and native code in mobile applications, particularly in hybrid app development.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The malicious code can lead to unauthorized access, data breaches, and potential system compromise, making it critical to address the vulnerability promptly.
Yes, you can remove the package from your project or monitor your application for unusual behavior until a secure version is released.
You can find more information about updates or patches on the official npm repository or the GitHub page of the jz-user-js-bridge package.
