Malicious Code Detected in Kubernetes-Helm Package - Security Alert
Summary
MAL-2025-191514: Malicious code in kubernetes-helm (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes-helm is a widely used package in the npm ecosystem that facilitates the management of Kubernetes applications through Helm charts. It allows developers to define, install, and upgrade even the most complex Kubernetes applications. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability originates from a malicious code injection in the kubernetes-helm package, identified by Amazon Inspector. This malicious code can potentially compromise the integrity of applications using this package, leading to unauthorized access, data breaches, or other malicious activities. The vulnerability affects all versions of the package starting from its introduction, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kubernetes-helmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users may consider removing the kubernetes-helm package from their projects until a secure version is released. This can be done with the command: 'npm uninstall kubernetes-helm'. Additionally, users can explore alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the kubernetes-helm package poses a serious threat to users and their applications. Immediate action is required to mitigate risks, including updating to a patched version or removing the package temporarily. Staying informed and utilizing tools like Vulert can help in monitoring and addressing such vulnerabilities effectively.
See every vulnerability recorded for kubernetes-helm →
FAQ
The malicious code can compromise application security, potentially leading to unauthorized access and data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Consider uninstalling the kubernetes-helm package and using alternative solutions until a secure version is available.
Regularly check the official npm repository and the GitHub page for kubernetes-helm for any announcements or patches.
The vulnerability was reported by Amazon Inspector, which identified the malicious code in the kubernetes-helm package.
