Critical Vulnerability in nuxt-keycloak: Malicious Code Exposure
Summary
MAL-2025-191400: Malicious code in nuxt-keycloak (npm). Affects nuxt-keycloak versions 0.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nuxt-keycloak is an npm package that integrates Keycloak authentication into Nuxt.js applications, providing a seamless way to manage user authentication and authorization. It is designed to enhance security in web applications by leveraging Keycloak's capabilities. However, this package has been compromised, exposing users to significant security risks.
Vulnerability Detail
The vulnerability originates from the Sha1-Hulud: The Second Coming NPM worm, which has infected the nuxt-keycloak package. This malicious code is designed to steal tokens and credentials from users and publish them to GitHub. Additionally, it can propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. The worm poses a severe risk as it may also destroy the user's home directory, leading to potential data loss and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nuxt-keycloakIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the nuxt-keycloak package from their project until a secure version is released. This can be done using the command: 'npm uninstall nuxt-keycloak'. Additionally, consider using alternative authentication methods or libraries that are not affected by this vulnerability.
Conclusion
The nuxt-keycloak package has been compromised by a malicious worm, posing serious security risks to users. It is essential to take immediate action by updating or removing the package and monitoring for any further vulnerabilities. Utilizing tools like Vulert can help in maintaining the security of your applications.
See every vulnerability recorded for nuxt-keycloak →
FAQ
nuxt-keycloak is an npm package that allows developers to integrate Keycloak authentication into their Nuxt.js applications, facilitating user management and security.
The worm introduces malicious code that steals user tokens and credentials, propagates to other packages, and can potentially destroy the user's home directory.
If you have installed nuxt-keycloak, it is crucial to uninstall the package immediately and monitor for any updates or patches from the maintainers.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities without signing up at the Vulert playground.
Failing to address this vulnerability can lead to unauthorized access to sensitive user data, potential data loss, and the risk of further propagation of the malicious code to other packages.
