Malicious Code Detected in pdfjs-dist-v5 Package - Version 100.25.0
Summary
MAL-2026-1216: Malicious code in pdfjs-dist-v5 (npm). Affects pdfjs-dist-v5 versions 100.25.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdfjs-dist-v5 is a popular JavaScript library used for rendering PDF documents in web applications. It allows developers to embed PDF viewing capabilities directly into their applications, providing users with a seamless experience. However, the version 100.25.0 has been flagged for containing malicious code, which poses significant security risks to users and applications relying on this package.
Vulnerability Detail
The vulnerability in pdfjs-dist-v5 arises from the package's ability to communicate with a domain linked to malicious activities. This communication can lead to the execution of harmful commands, potentially compromising the security of the host application and its users. The origin of this vulnerability is traced back to the package analysis conducted by OpenSSF, which identified the malicious behavior associated with this specific version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pdfjs-dist-v5If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the affected version of the package from your project and avoid using pdfjs-dist-v5 until a secure version is confirmed. Additionally, consider using alternative libraries for PDF rendering that do not exhibit such vulnerabilities.
Conclusion
The detection of malicious code in the pdfjs-dist-v5 package version 100.25.0 poses a significant risk to applications using this library. It is essential to update to a secure version or consider alternative solutions to mitigate potential threats. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for pdfjs-dist-v5 →
FAQ
pdfjs-dist-v5 is a JavaScript library that enables web applications to render PDF documents directly in the browser.
The malicious code can communicate with harmful domains and execute commands that may compromise your application's security and user data.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application for this vulnerability using the Vulert playground without any signup.
If an immediate update is not possible, consider removing the package and using alternative libraries until a secure version is available.
Utilize tools like Vulert, which can monitor your package-lock.json file and alert you in real-time about any open-source vulnerabilities.
