Malicious Code Vulnerability in kmf-vendor-pack: Data Leakage on Installation
Summary
MAL-2026-17744: Malicious code in kmf-vendor-pack (npm). Affects kmf-vendor-pack versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kmf-vendor-pack is an npm package that is typically used for managing vendor dependencies in JavaScript applications. It is designed to streamline the process of including third-party libraries. However, this package has been identified as malicious due to a postinstall script that executes harmful code upon installation, leading to potential data leakage.
Vulnerability Detail
The vulnerability originates from a postinstall script defined in the package.json file of kmf-vendor-pack. This script executes a Node.js command that sends an HTTPS GET request to an attacker-controlled server, embedding sensitive information such as the installer's OS hostname and username in the request. This automatic execution occurs during the npm install process, allowing the attacker to gain unauthorized access to host-identifying data without any user interaction. The ramifications include potential privacy violations and exploitation of the leaked data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kmf-vendor-packIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the kmf-vendor-pack package until a secure version is released. Additionally, you can manually inspect the package.json file to remove or disable the postinstall script to prevent the malicious code from executing.
Conclusion
The kmf-vendor-pack package contains a serious vulnerability that allows for the execution of malicious code during installation, leading to data leakage. It is crucial to update or remove this package to protect sensitive information and maintain application security.
See every vulnerability recorded for kmf-vendor-pack →
FAQ
kmf-vendor-pack is an npm package used for managing vendor dependencies in JavaScript applications.
The vulnerability works by executing a postinstall script that sends sensitive information to an attacker-controlled server during the installation process.
The vulnerability leaks the installer's OS hostname and username, which can be used for malicious purposes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, consider removing it from your project and looking for alternative packages that provide similar functionality.
