Malicious Code Vulnerability in oracle-redis Package
Summary
MAL-2026-16390: Malicious code in oracle-redis (npm). Affects oracle-redis versions 5.11.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oracle-redis package is an npm package that claims to provide functionality similar to the popular ioredis library. It is intended for use in Node.js applications to interact with Redis databases. However, this package is a malicious copy of ioredis, containing extraneous dependencies that can lead to security risks.
Vulnerability Detail
The vulnerability arises from the oracle-redis package, which is a verbatim copy of the ioredis README and source code, misleading users into believing it is the legitimate library. It includes two additional runtime dependencies, redis-type-intel and pino-ulid, which are not part of the original ioredis package. These dependencies are installed when oracle-redis is added to a project, potentially executing harmful lifecycle scripts. This situation creates a dependency-delivery vector for malicious code, as the extra dependencies can introduce vulnerabilities or unwanted behavior into the user's application.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall oracle-redisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate removal of the oracle-redis package is not feasible, consider using a local version of ioredis while monitoring your application for any unexpected behavior. You can also restrict the installation of the additional dependencies by using npm's package-lock.json to lock down your dependencies.
Conclusion
The oracle-redis package presents a significant security risk due to its malicious nature and the inclusion of extraneous dependencies. Users are strongly advised to remove this package and replace it with the legitimate ioredis package to safeguard their applications.
See every vulnerability recorded for oracle-redis →
FAQ
The oracle-redis package is an npm package that falsely claims to be a version of the ioredis library, which is used for interacting with Redis databases in Node.js applications.
The vulnerability can lead to the installation of malicious dependencies that may execute harmful code, potentially compromising your application's security.
You should uninstall the oracle-redis package and install the legitimate ioredis package to ensure your application is secure.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without needing to sign up.
Always verify the authenticity of packages before installation, and consider using tools like Vulert to monitor your dependencies for vulnerabilities.
