Malicious Code Detected in mapkit-example-vanillajs Package - Version 1.3.0
Summary
MAL-2026-327: Malicious code in mapkit-example-vanillajs (npm). Affects mapkit-example-vanillajs versions 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'mapkit-example-vanillajs' package is a JavaScript library designed to facilitate the use of Apple's MapKit JS framework in web applications. It allows developers to integrate interactive maps and location-based features into their projects. However, version 1.3.0 of this package has been flagged for containing malicious code that executes harmful commands, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the OpenSSF Package Analysis project, which identified the 'mapkit-example-vanillajs' package version 1.3.0 as malicious. The package executes commands associated with malicious behavior, potentially compromising the security of applications that depend on it. This could lead to unauthorized access, data breaches, or other harmful actions within the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mapkit-example-vanillajsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package from your project until a safe version is released. You can do this by running: npm uninstall mapkit-example-vanillajs. Additionally, monitor your application for any unusual behavior that may indicate exploitation of this vulnerability.
Conclusion
The 'mapkit-example-vanillajs' package version 1.3.0 has been identified as malicious, executing harmful commands that can compromise application security. It is essential to update or remove this package to safeguard your projects. Utilize tools like Vulert for ongoing monitoring of open-source vulnerabilities.
See every vulnerability recorded for mapkit-example-vanillajs →
FAQ
The package executes commands that can lead to unauthorized actions within your application, potentially compromising sensitive data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
Regularly audit your dependencies and utilize tools like Vulert to monitor for vulnerabilities in real-time.
Consider removing the package from your project and monitoring for any unusual behavior until a safe version is available.
Detailed information can be found in the OpenSSF Package Analysis report and the package's repository on GitHub.
