Critical Malicious Code Vulnerability in normal-store Package
Summary
MAL-2025-191135: Malicious code in normal-store (npm). Affects normal-store versions 1.3.1 – 1.3.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The normal-store package is a Node.js library commonly used for managing and storing data in a structured format. It is designed to facilitate easy data manipulation and retrieval for developers. However, the package has been found to contain malicious code that compromises the security of any system it is installed on, making it a significant risk for users and developers alike.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the normal-store package. This code can lead to full system compromise, allowing attackers to gain unauthorized access to sensitive information, including secrets and keys stored on the affected system. Users are advised to treat any system running this package as fully compromised, as simply removing the package may not eliminate all traces of the malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall normal-storeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks posed by the normal-store package. The only recommended action is to uninstall the package and secure your system.
Conclusion
The discovery of malicious code in the normal-store package poses a serious threat to users and developers. Immediate action is required to remove the package and secure any compromised systems. Regular monitoring and using tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for normal-store →
FAQ
You should immediately uninstall the normal-store package and rotate any sensitive information stored on your system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Keeping the normal-store package installed poses a significant risk of unauthorized access to your system and sensitive data.
After removing the package, ensure to rotate all secrets and keys, and consider performing a security audit on your system.
While removing the package is essential, there is no guarantee that all malicious software will be removed. A thorough security check is recommended.
