Critical Malicious Code Vulnerability in libxmljs2-malicious Package
Summary
MAL-2026-1775: Malicious code in libxmljs2-malicious (npm). Affects libxmljs2-malicious versions 0.19.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxmljs2-malicious is an npm package designed for XML parsing and manipulation in Node.js applications. It provides a simple interface for developers to work with XML data. However, this package has been identified as containing malicious code, which poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the libxmljs2-malicious package. This code can potentially compromise the security of applications by allowing unauthorized access, data manipulation, or execution of harmful operations. The malicious nature of this package was identified by ReversingLabs, which reported the issue on March 18, 2026. The affected version is 0.19.9, and users of this package should be aware of the risks associated with its use.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall libxmljs2-maliciousIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the libxmljs2-malicious package altogether and utilize other XML parsing libraries such as 'xml2js' or 'fast-xml-parser'. For example, to install 'xml2js', run: npm install xml2js.
Conclusion
The libxmljs2-malicious package poses a significant security threat due to the presence of malicious code. Users are advised to uninstall this package and switch to safer alternatives to protect their applications from potential exploits.
See every vulnerability recorded for libxmljs2-malicious →
FAQ
libxmljs2-malicious is an npm package for XML parsing in Node.js, which has been found to contain malicious code.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
You should uninstall the package immediately and consider using a secure alternative for XML parsing.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
No, there is no patch available for libxmljs2-malicious. The recommended action is to uninstall the package.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
