Malicious Code Vulnerability in lbank-connector-nodejs Package
Summary
MAL-2025-191579: Malicious code in lbank-connector-nodejs (npm). Affects lbank-connector-nodejs versions 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lbank-connector-nodejs package is a Node.js library designed to facilitate interactions with the LBank cryptocurrency exchange. It provides developers with tools to access market data, execute trades, and manage user accounts. However, this package has been identified as containing malicious code, which poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the lbank-connector-nodejs package, specifically in version 2.0.0. This code can compromise the security of applications by potentially allowing unauthorized access to sensitive data or enabling remote code execution. The malicious nature of this code was reported by ReversingLabs, highlighting the importance of scrutinizing third-party packages before integration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lbank-connector-nodejsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the lbank-connector-nodejs package until a secure version is released. Additionally, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The lbank-connector-nodejs package has been identified as containing malicious code, posing significant risks to applications that utilize it. Users are advised to update or remove the package to mitigate potential security threats. Regular monitoring of dependencies is essential to maintain application security.
See every vulnerability recorded for lbank-connector-nodejs →
FAQ
It is a Node.js library for interacting with the LBank cryptocurrency exchange, allowing developers to access market data and execute trades.
The malicious code can compromise application security by allowing unauthorized access to sensitive data or enabling remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should update the lbank-connector-nodejs package to a patched version or remove it from your project until a secure version is available.
The vulnerability was reported by ReversingLabs, a security research firm specializing in identifying malicious packages.
