Malicious Code Detected in kmz1 Package: npm Vulnerability Alert
Summary
MAL-2025-191949: Malicious code in kmz1 (npm). Affects kmz1 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kmz1 package, available on npm, is designed for specific functionalities related to file handling and data processing. However, it has been flagged for malicious behavior, which poses significant risks to users and their applications. The package's version 1.0.0 has been identified as compromised, leading to potential security breaches.
Vulnerability Detail
The kmz1 package has been identified as malicious due to its communication with a domain associated with harmful activities and its execution of commands that can lead to malicious behavior. This vulnerability was discovered by the OpenSSF Package Analysis project, which monitors and assesses the security of open-source packages. Users of this package may unknowingly expose their systems to risks such as data theft, unauthorized access, and other forms of cyberattacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kmz1If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the kmz1 package by removing it from your dependencies. Use the following command to uninstall the package: npm uninstall kmz1.
Conclusion
The kmz1 package has been identified as malicious, posing significant risks to users. It is crucial to remove this package from your projects and monitor your dependencies for vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your applications.
See every vulnerability recorded for kmz1 →
FAQ
The kmz1 package is an npm package used for specific functionalities related to file handling and data processing.
The kmz1 package was flagged as malicious by the OpenSSF Package Analysis project due to its communication with a harmful domain and execution of malicious commands.
Using the kmz1 package can expose your system to data theft, unauthorized access, and other cyber threats.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your package-lock.json file, you can check for vulnerabilities without needing to install any software.
The best way to mitigate risks is to uninstall the kmz1 package and replace it with a secure alternative. Regularly monitoring your dependencies with tools like Vulert can also help.
