Malicious Code Detected in no6gg Package - Critical Vulnerability Alert
Summary
MAL-2026-1801: Malicious code in no6gg (npm). Affects no6gg versions 1.0.0 – 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The no6gg package is a JavaScript library available through npm, designed to facilitate various functionalities in Node.js applications. However, it has been identified as containing malicious code, which poses significant risks to users and their applications. This vulnerability affects multiple versions of the package, making it crucial for developers to be aware of its implications.
Vulnerability Detail
The vulnerability in the no6gg package arises from the inclusion of malicious code that can compromise the security of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious nature of this vulnerability is confirmed by security researchers, emphasizing the need for immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall no6ggIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the no6gg package from their project until a secure version is released. This can be done by running the following command: npm uninstall no6gg. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The no6gg package has been identified as containing malicious code, posing a significant risk to applications that utilize it. Immediate action is required to update or remove the package to safeguard your projects. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for no6gg →
FAQ
The no6gg package is a JavaScript library available on npm, used in Node.js applications for various functionalities.
The vulnerability involves malicious code embedded within the package, which can lead to security breaches and unauthorized access to applications.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without any signup.
You should immediately update the no6gg package to the latest patched version or uninstall it until a secure version is available.
Detailed information can be found on the GitHub repository of the malicious packages, specifically at https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/no6gg/MAL-2026-1801.json.
