Malicious Code Detected in Microsoft CMS Client: npm Package Vulnerability
Summary
MAL-2026-978: Malicious code in microsoft-cms-client (npm). Affects microsoft-cms-client versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'microsoft-cms-client' package is a Node.js library designed for managing content in Microsoft CMS environments. It is widely used for its ease of integration and functionality in web applications. However, version 99.0.0 has been flagged for malicious activity, raising concerns about its security and integrity.
Vulnerability Detail
The vulnerability in the 'microsoft-cms-client' package arises from its communication with a domain associated with malicious activities. This could potentially lead to data breaches, unauthorized access, or other security incidents. The OpenSSF Package Analysis project identified this issue, emphasizing the need for immediate attention from users of this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall microsoft-cms-clientIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package from your project or replacing it with an alternative library that offers similar functionality without the associated risks.
Conclusion
The 'microsoft-cms-client' package version 99.0.0 has been identified as malicious due to its communication with harmful domains. Users are urged to update or remove the package to mitigate potential risks. Tools like Vulert can assist in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for microsoft-cms-client →
FAQ
It is a Node.js library used for managing content in Microsoft CMS environments, facilitating integration and functionality in web applications.
A malicious package is one that engages in harmful activities, such as communicating with harmful domains or compromising user data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider removing the package or replacing it with a safer alternative until you can update to a patched version.
Utilize tools like Vulert that provide real-time monitoring and alerts for open-source vulnerabilities in your software.
