Malicious Code Detected in nested-lib: A Security Risk for npm Users
Summary
MAL-2026-17773: Malicious code in nested-lib (npm). Affects nested-lib versions 1.0.0 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nested-lib package is an npm library that is designed to provide certain functionalities within JavaScript applications. However, it has been identified as containing malicious code that compromises user data and system integrity. The package executes a script during installation that sends sensitive information to an unauthorized external server, making it a significant security threat.
Vulnerability Detail
The vulnerability originates from the nested-lib package, which includes a post-install script that executes a beacon script (beacon.cjs). This script sends sensitive information, such as the operating system hostname, current working directory, and Node.js version, to a hardcoded IP address over plain HTTP. This behavior is indicative of a reconnaissance beacon, which is typically used to confirm successful installation in target environments, potentially leading to further malicious actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nested-libIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the nested-lib package from your project by executing 'npm uninstall nested-lib'. This will prevent the malicious code from executing until a secure version is released.
Conclusion
The nested-lib package has been identified as containing malicious code that poses a significant security risk to users. Immediate action is recommended to either update or uninstall the package to protect sensitive information and maintain system integrity.
See every vulnerability recorded for nested-lib →
FAQ
The vulnerability involves the execution of malicious code that sends sensitive information to an unauthorized external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider uninstalling the nested-lib package to mitigate the risk until a secure version is available.
Yes, the vulnerability poses a risk of data theft as it transmits sensitive information to an external server without user consent.
Detailed information about the vulnerability can be found in the Open Source Vulnerability database or by consulting the package's repository.
