Malicious Code Vulnerability in netlify-claude-ai Package
Summary
MAL-2026-1796: Malicious code in netlify-claude-ai (npm). Affects netlify-claude-ai versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netlify-claude-ai package is an npm library designed to facilitate AI functionalities within Netlify applications. It provides developers with tools to integrate AI capabilities seamlessly. However, this package has been identified with a serious vulnerability that allows for the execution of malicious code, potentially compromising user systems and data.
Vulnerability Detail
The vulnerability in netlify-claude-ai arises from the inclusion of malicious code within its versions 1.0.0 and 1.0.1. This code can execute unauthorized actions on the user's system, leading to data breaches or system corruption. The origin of this vulnerability is linked to a malicious actor who has tampered with the package, making it imperative for users to be vigilant about the packages they incorporate into their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall netlify-claude-aiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the netlify-claude-ai package from their project until a secure version is confirmed. This can be done using the command: npm uninstall netlify-claude-ai.
Conclusion
The netlify-claude-ai package has been compromised with malicious code, posing a serious risk to users. It is crucial to update to a secure version or remove the package until a fix is available. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for netlify-claude-ai →
FAQ
netlify-claude-ai is an npm package that allows developers to integrate AI functionalities into their Netlify applications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities in your package-lock.json.
If an immediate update is not possible, consider removing the package from your project as a temporary measure to mitigate risks.
While specific exploits have not been detailed, the presence of malicious code poses a significant risk of unauthorized access and data breaches.
The vulnerability was identified by ReversingLabs, a cybersecurity firm specializing in threat detection.
