Malicious Code Detected in promanage Package - Version 6.0.21
Summary
MAL-2026-1038: Malicious code in promanage (npm). Affects promanage versions 6.0.21. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'promanage' package is a tool available on npm that is designed to assist with project management tasks. It provides functionalities that streamline various processes within software development. However, version 6.0.21 has been flagged for containing malicious code that compromises its integrity and poses security risks to users.
Vulnerability Detail
The vulnerability in the 'promanage' package arises from its communication with a domain associated with malicious activities. This behavior indicates that the package may execute harmful commands, potentially leading to unauthorized access or data breaches. The OpenSSF Package Analysis project identified this issue, emphasizing the need for users to be cautious when using this version of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall promanageIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to avoid using the 'promanage' package altogether until a secure version is confirmed. Users can also monitor their applications for any unusual behavior that may arise from using this package.
Conclusion
The 'promanage' package version 6.0.21 has been identified as malicious due to its harmful behavior. Users are advised to update to a secure version promptly and to monitor their applications for any unusual activity. Utilizing tools like Vulert can help in maintaining the security of your software projects.
See every vulnerability recorded for promanage →
FAQ
The malicious behavior includes communication with a domain linked to harmful activities and executing commands that could compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply uploading your package-lock.json file, you can check for vulnerabilities without requiring any installation.
If you cannot update the package right away, consider avoiding its use until a secure version is available, and monitor your application for any suspicious activity.
Yes, using tools like Vulert allows you to automate the monitoring of your project for vulnerabilities by analyzing your package-lock.json file.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis report, which provides insights into the malicious nature of the 'promanage' package.
