Malicious Code Vulnerability in liferay-workspace-scripts: npm Package Compromise
Summary
MAL-2026-17772: Malicious code in liferay-workspace-scripts (npm). Affects liferay-workspace-scripts versions 99.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The liferay-workspace-scripts package is part of the Liferay ecosystem, designed to assist developers in managing Liferay projects. It provides scripts and tools that streamline the development process. However, this package has been found to contain a malicious dependency that poses a significant security risk to users.
Vulnerability Detail
The vulnerability stems from the package.json file of liferay-workspace-scripts, which declares a dependency on 'ltidisafe' as a bare HTTPS tarball URL instead of a version range from a trusted registry. This allows npm to fetch and execute any code from the specified URL during installation, without integrity checks or version pinning. The malicious package can execute arbitrary code on the user's machine, leading to potential data breaches or system compromises. The package name and implausibly high version number suggest a dependency confusion attack, where the malicious package is designed to override legitimate internal packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall liferay-workspace-scriptsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the liferay-workspace-scripts package until a secure version is released. Additionally, consider using npm audit to check for vulnerabilities in your project dependencies.
Conclusion
The liferay-workspace-scripts package contains a serious vulnerability due to a malicious dependency that can execute arbitrary code on users' machines. It is essential to update to a secure version and monitor your dependencies to mitigate risks.
See every vulnerability recorded for liferay-workspace-scripts →
FAQ
The malicious code is embedded in a dependency that is fetched from an untrusted URL, allowing it to execute arbitrary code on the user's machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If you have installed the affected package, it is crucial to uninstall it immediately and update to a secure version of liferay-workspace-scripts.
While specific exploits have not been publicly disclosed, the nature of the vulnerability allows for arbitrary code execution, which can lead to severe security breaches.
To prevent similar vulnerabilities, always use trusted package sources, regularly audit your dependencies, and keep your packages updated.
