Critical Vulnerability in pkg-readme: Malicious Code Injection and Data Theft
Summary
MAL-2025-191401: Malicious code in pkg-readme (npm). Affects pkg-readme versions 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pkg-readme is an npm package designed to assist developers in managing and displaying README files for their projects. It simplifies the process of creating and maintaining documentation, which is crucial for open-source projects. However, this package has been compromised, making it susceptible to a severe security threat that can lead to unauthorized access and data loss.
Vulnerability Detail
The vulnerability stems from a malicious code injection caused by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal sensitive tokens and credentials from users and publish them to GitHub. It can propagate itself to other npm packages owned by the user and establish persistence through a GitHub action. Additionally, the worm has the potential to destroy the user's home directory, leading to significant data loss and operational disruption.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pkg-readmeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to remove the pkg-readme package from their projects until a secure version is confirmed. You can uninstall the package using the following command: npm uninstall pkg-readme.
Conclusion
The pkg-readme package has been compromised by a malicious worm that poses significant risks to users by stealing sensitive information and potentially damaging their systems. Immediate action is required to mitigate these risks by updating or removing the package.
See every vulnerability recorded for pkg-readme →
FAQ
The vulnerability involves a malicious worm that steals credentials and can propagate to other npm packages.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
If you have installed pkg-readme, it is crucial to uninstall it immediately and monitor your system for any unauthorized access.
Yes, users should update to the latest patched version of pkg-readme to mitigate the vulnerability.
Yes, the worm can propagate to other npm packages you own, potentially compromising your entire project.
