Critical Malicious Code Vulnerability in pearpass-lib-vault-core Package
Summary
MAL-2026-1239: Malicious code in pearpass-lib-vault-core (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pearpass-lib-vault-core package is a library designed for managing secrets and keys in Node.js applications. It provides developers with tools to securely store and retrieve sensitive information. However, this package has been identified as containing malicious code, posing a significant risk to any system where it is installed.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the pearpass-lib-vault-core package. This code can compromise the entire system, allowing unauthorized access to secrets and keys stored on the affected machine. As a result, any computer running this package should be considered fully compromised, necessitating immediate action to mitigate the risks associated with this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pearpass-lib-vault-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. It is recommended to audit your application's dependencies and ensure that no other malicious packages are present.
Conclusion
The pearpass-lib-vault-core package contains malicious code that poses a severe risk to any system using it. Immediate removal of the package and rotation of any stored secrets is essential to mitigate potential damage. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for pearpass-lib-vault-core →
FAQ
Immediately remove the package and rotate any secrets or keys stored on the affected machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability can lead to unauthorized access to sensitive information, potentially resulting in data breaches and loss of control over your systems.
Currently, there is no patch available. The recommended action is to remove the package entirely.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about security advisories related to the packages you use.
