Malicious Code Vulnerability in libxmljs2var Package
Summary
MAL-2026-1782: Malicious code in libxmljs2var (npm). Affects libxmljs2var versions 0.30.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxmljs2var is a JavaScript library designed for parsing and manipulating XML documents in Node.js applications. It provides a simple API for developers to work with XML data, making it easier to integrate XML processing into their applications. However, the package has been found to contain malicious code, posing a significant security risk to users who rely on it.
Vulnerability Detail
The vulnerability in libxmljs2var stems from the inclusion of malicious code that can compromise the security of applications using this package. This code may allow unauthorized access to sensitive data, execute arbitrary commands, or lead to further exploitation of the system. The malicious nature of the code was identified through analysis by security researchers, highlighting the importance of scrutinizing third-party packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall libxmljs2varIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider removing libxmljs2var from your project and replacing it with a more secure alternative for XML processing. Additionally, review your application's dependencies to ensure no other vulnerable packages are present.
Conclusion
The discovery of malicious code in the libxmljs2var package poses a serious threat to applications utilizing this library. It is crucial for developers to update to a secure version and consider alternatives if necessary. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for libxmljs2var →
FAQ
libxmljs2var is a Node.js library for parsing and manipulating XML documents, providing a straightforward API for developers.
The malicious code was identified by security researchers from ReversingLabs during a routine analysis of npm packages.
Using the compromised version of libxmljs2var can lead to unauthorized access to sensitive data, execution of arbitrary commands, and potential system exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one. You can also check your application using the Vulert playground without signup.
If immediate updates are not possible, consider removing the libxmljs2var package and using a secure alternative for XML processing until you can address the vulnerability.
