Critical Malicious Code Vulnerability in parse-session Package
Summary
MAL-2025-190630: Malicious code in parse-session (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The parse-session package is a Node.js library used for managing user sessions in web applications. It provides functionality for creating, storing, and validating session data, making it a crucial component for maintaining user state and security in web applications. However, this package has been compromised, leading to severe security risks for any application utilizing it.
Vulnerability Detail
The vulnerability originates from the presence of malicious code embedded within the parse-session package. This code can fully compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information such as secrets and keys. The implications of this vulnerability are severe, as it can lead to data breaches, loss of control over the affected systems, and potential exploitation by malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall parse-sessionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is advised to temporarily disable any functionality relying on the parse-session package until it can be safely removed and replaced with a secure alternative.
Conclusion
The parse-session package has been identified as containing malicious code that compromises the security of any system using it. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for parse-session →
FAQ
Immediately remove the parse-session package and rotate all sensitive keys and secrets stored on the affected system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and complete control of your system by malicious actors.
It is recommended to find a secure alternative to parse-session, as using it poses significant security risks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
