Malicious Code Vulnerability in polyfill-corejs2 Package
Summary
MAL-2025-192852: Malicious code in polyfill-corejs2 (npm). Affects polyfill-corejs2 versions 8.9.0 – 8.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The polyfill-corejs2 package is a JavaScript library that provides polyfills for ECMAScript features, enabling developers to use modern JavaScript functionalities in older environments. It is widely used in web development to ensure compatibility across different browsers. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant security risks to applications that rely on it.
Vulnerability Detail
The vulnerability in the polyfill-corejs2 package stems from the inclusion of malicious code in versions 8.9.0 and 8.9.1. This code can potentially compromise the security of applications by allowing unauthorized access or manipulation of data. The malicious code was identified by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall polyfill-corejs2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the polyfill-corejs2 package from your project and replacing it with alternative polyfill solutions that do not have known vulnerabilities.
Conclusion
The polyfill-corejs2 package has been found to contain malicious code in specific versions, posing a significant security risk. It is essential for developers to update to the latest version or consider alternative solutions to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for polyfill-corejs2 →
FAQ
polyfill-corejs2 is a JavaScript library that provides polyfills for ECMAScript features, allowing developers to use modern JavaScript functionalities in older environments.
Versions 8.9.0 and 8.9.1 of the polyfill-corejs2 package contain malicious code and should be updated immediately.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can provide real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update the package immediately, consider removing it from your project and using alternative polyfill solutions that do not have known vulnerabilities.
The vulnerability was identified by ReversingLabs, a cybersecurity firm that specializes in detecting malicious code in software packages.
