Malicious Code Injection in ksp-app: A Dependency Confusion Vulnerability
Summary
MAL-2026-17770: Malicious code in ksp-app (npm). Affects ksp-app versions 100.100.100. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ksp-app is an npm package designed to provide frontend utilities. However, it has been identified as a dependency-confusion shaped package that poses significant security risks. The package's functionality is compromised by the inclusion of a malicious native binary that executes harmful actions upon installation, making it a target for exploitation.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded in the ksp-app package version 100.100.100. This package contains a prebuilt Linux x64 native addon that is executed during the installation process. The addon collects sensitive environment variables such as HOSTNAME, npm_package_name, and npm_config_registry, and sends them to a hardcoded IP address (http://64.181.165.115/dc). This behavior indicates that the package is designed to exfiltrate information about the victim's environment, potentially leading to further attacks or data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ksp-appIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the ksp-app package altogether or replace it with an alternative package that provides similar functionality without the associated risks.
Conclusion
The ksp-app package has been identified as containing malicious code that poses a significant security threat. Users are advised to remove the affected version and update to a secure alternative. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for ksp-app →
FAQ
ksp-app is an npm package that provides frontend utilities but has been compromised with malicious code.
The vulnerability works by executing a malicious native binary during installation, which sends sensitive information to a remote server.
The risks include exposure of sensitive environment variables, potential data breaches, and further exploitation of the victim's system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package and using alternative solutions until a secure version is available.
