Malicious Code Injection in nitro-bundled-dep Package - Version 99.0.1
Summary
MAL-2026-17774: Malicious code in nitro-bundled-dep (npm). Affects nitro-bundled-dep versions 1.1.0 – 99.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nitro-bundled-dep package is an npm library that is designed to manage dependencies for JavaScript applications. It is intended to streamline the installation and management of bundled dependencies. However, the version 99.0.1 of this package has been found to contain malicious code that compromises the security of applications using it.
Vulnerability Detail
The vulnerability originates from the inclusion of a malicious beacon script (beacon.cjs) that executes during the post-install lifecycle of the package. This script collects sensitive information such as the operating system hostname, installation path, current working directory, and Node.js version, and sends this data to a hardcoded IP address (185.158.107.175:8787) over plain HTTP. This behavior is not configurable by the user and poses significant risks, including unauthorized data exposure and potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nitro-bundled-depIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not possible, consider removing the nitro-bundled-dep package from your project until a secure version is released. You can do this by executing:
npm uninstall nitro-bundled-dep
Additionally, monitor your application for any unusual behavior that may indicate exploitation of this vulnerability.
Conclusion
The nitro-bundled-dep package version 99.0.1 contains a serious vulnerability due to malicious code that compromises user data. It is crucial to update to a secure version or remove the package to protect your application. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for nitro-bundled-dep →
FAQ
nitro-bundled-dep is an npm package used for managing dependencies in JavaScript applications.
The malicious code collects sensitive information from your system and sends it to an external server, potentially leading to data breaches.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update the package, consider uninstalling it and monitoring your application for any suspicious activity.
Regularly update your dependencies, use tools like Vulert for real-time monitoring, and review package integrity before installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
