Malicious Code Vulnerability in pf25262 Package: Browser Exfiltration Risk
Summary
MAL-2026-16340: Malicious code in pf25262 (npm). Affects pf25262 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pf25262 package is an npm library that is designed for use in JavaScript applications. It is typically utilized for various functionalities within web applications. However, this package has been found to contain malicious code that poses a significant security risk by exfiltrating sensitive user data.
Vulnerability Detail
The vulnerability originates from a malicious snippet in the index.js file of the pf25262 package. This code performs unauthorized data exfiltration by issuing a credentialed fetch request to the '/profile' endpoint. It attempts to extract a DGA token or, if that fails, captures the document.cookie and the response length. The captured data is then sent to an attacker-controlled URL at webhook.site, which could lead to unauthorized access to user credentials and sensitive information. The entire payload of the package is dedicated to this malicious activity, making it a severe threat to users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pf25262If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using an alternative package that provides similar functionality without the associated risks. Additionally, ensure that your application has proper security measures in place, such as Content Security Policy (CSP) headers, to mitigate the risk of data exfiltration.
Conclusion
The pf25262 package contains a serious vulnerability that allows for the exfiltration of sensitive user data. It is essential to remove this package from your project and monitor for any potential impacts. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for pf25262 →
FAQ
pf25262 is an npm package used in JavaScript applications, but it has been identified to contain malicious code that can exfiltrate user data.
The vulnerability allows attackers to capture sensitive user information, such as cookies and session tokens, which can lead to unauthorized access to user accounts.
Immediately remove the pf25262 package from your project and monitor your application for any suspicious activity.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and keep your packages updated to the latest secure versions.
