Malicious Code Detected in kc-next Package - Version 2.3.2
Summary
MAL-2025-190574: Malicious code in kc-next (npm). Affects kc-next versions 2.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kc-next package is a Node.js library available via npm, designed to facilitate various functionalities within JavaScript applications. It is commonly used for its ease of integration and utility in managing tasks. However, version 2.3.2 of kc-next has been flagged for malicious behavior, which poses significant risks to applications utilizing this package.
Vulnerability Detail
The vulnerability in kc-next arises from the execution of commands that are associated with malicious behavior. This was identified by the OpenSSF Package Analysis project, which flagged version 2.3.2 as malicious. The implications of this vulnerability can lead to unauthorized access, data breaches, or the execution of harmful scripts within the application, potentially compromising the integrity and security of the software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kc-nextIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the kc-next package from your project until a secure version is released. You can do this by executing the command: 'npm uninstall kc-next'. Additionally, monitor your application for any signs of malicious activity.
Conclusion
The kc-next package version 2.3.2 has been identified as malicious, posing significant risks to applications that utilize it. It is crucial to update to a secure version or remove the package until a fix is available. Regular monitoring and using tools like Vulert can help maintain application security.
See every vulnerability recorded for kc-next →
FAQ
kc-next is a Node.js library that provides various functionalities for JavaScript applications, commonly used for its ease of integration.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 2.3.2 of kc-next for executing commands associated with harmful actions.
Using the compromised version can lead to unauthorized access, data breaches, and execution of harmful scripts, compromising application security.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, consider removing the package temporarily and monitoring your application for any signs of malicious activity.
