Malicious Code Vulnerability in no-unsanitized Package
Summary
MAL-2025-192824: Malicious code in no-unsanitized (npm). Affects no-unsanitized versions 9.9.1 – 9.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The no-unsanitized package is a utility in the npm ecosystem that is designed to facilitate the handling of unsanitized HTML content in web applications. It is commonly used in projects that require direct manipulation of HTML without automatic sanitization, allowing developers to maintain control over the content. However, this functionality can also expose applications to security risks if not handled properly, making it crucial for developers to stay informed about vulnerabilities associated with this package.
Vulnerability Detail
The vulnerability identified as MAL-2025-192824 involves the presence of malicious code within specific versions of the no-unsanitized package (versions 9.9.1 and 9.9.2). This malicious code can potentially lead to unauthorized access, data breaches, or the execution of harmful scripts within applications that utilize this package. The origin of this vulnerability is linked to the package being compromised, which raises significant concerns about the integrity of the code being used in production environments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall no-unsanitizedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input sanitization on your application level to mitigate the risks associated with using unsanitized HTML content. This can be done by using libraries such as DOMPurify to sanitize user inputs before rendering them in the application.
Conclusion
The no-unsanitized package has been identified to contain malicious code in specific versions, posing serious security risks to applications that utilize it. Developers are urged to update to a secure version and consider implementing additional sanitization measures to protect their applications.
See every vulnerability recorded for no-unsanitized →
FAQ
The no-unsanitized package is an npm utility that allows developers to handle unsanitized HTML content directly in their applications.
Versions 9.9.1 and 9.9.2 of the no-unsanitized package are affected by the malicious code vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Using the compromised version can lead to unauthorized access, data breaches, and the execution of harmful scripts, posing significant security risks to your application.
If immediate updating is not possible, implement input sanitization on your application level to reduce the risks associated with unsanitized HTML content.
