Critical Malicious Code Vulnerability in nanoreset Package
Summary
MAL-2025-190978: Malicious code in nanoreset (npm). Affects nanoreset versions 7.0.1 – 7.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nanoreset package is an npm library designed for resetting or clearing configurations in various applications. It is often utilized in development environments to ensure a clean state. However, recent findings have revealed that this package contains malicious code, posing significant security risks to systems that utilize it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the nanoreset package. This code can compromise any system where the package is installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code has been confirmed by multiple sources, including Amazon Inspector and GHSA, indicating that any system running this package should be considered fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nanoresetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can isolate the affected system from the network to prevent further unauthorized access while you address the vulnerability. However, this does not eliminate the need to remove the package and secure your secrets.
Conclusion
The discovery of malicious code within the nanoreset package poses a serious threat to users and systems that utilize it. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for nanoreset →
FAQ
The nanoreset package is an npm library used for resetting configurations in applications, but it has been found to contain malicious code.
If you have installed the nanoreset package, especially versions 7.0.1 or 7.0.2, your system is likely compromised.
You should rotate all secrets and keys immediately from a different, secure computer to prevent unauthorized access.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
