Critical Malicious Code Vulnerability in prompt-eng-server Package
Summary
MAL-2025-191403: Malicious code in prompt-eng-server (npm). Affects prompt-eng-server versions 1.0.18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The prompt-eng-server package is an npm module designed for facilitating prompt engineering in various applications. It allows developers to create and manage prompts efficiently. However, this package has been compromised, making it susceptible to a severe security threat that can affect users' credentials and system integrity.
Vulnerability Detail
The vulnerability originates from the Sha1-Hulud: The Second Coming NPM worm, which has infected the prompt-eng-server package. This malicious code is capable of stealing tokens and credentials, which are then published to GitHub. Furthermore, the worm can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. In extreme cases, it may also lead to the destruction of the user's home directory, posing a significant risk to data integrity and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall prompt-eng-serverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should consider removing the prompt-eng-server package from their projects until a secure version is released. You can uninstall the package using the following command: npm uninstall prompt-eng-server.
Conclusion
The prompt-eng-server package has been compromised by a malicious worm that poses significant risks to users' security and data integrity. It is crucial to take immediate action by updating or uninstalling the package and monitoring for any unauthorized access to your accounts. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for prompt-eng-server →
FAQ
The prompt-eng-server package is an npm module used for managing and creating prompts in applications, facilitating prompt engineering.
The worm can steal sensitive tokens and credentials, potentially leading to unauthorized access to your accounts and data loss.
You should immediately uninstall the prompt-eng-server package and monitor your accounts for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without needing to sign up.
Regularly update your packages, monitor for vulnerabilities using tools like Vulert, and review the security practices of the packages you use.
