Critical Malicious Code Vulnerability in pulse-rsvp-card-entity Package
Summary
MAL-2026-2093: Malicious code in pulse-rsvp-card-entity (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pulse-rsvp-card-entity package is an npm library designed to facilitate RSVP card functionalities in web applications. It allows developers to easily integrate RSVP features into their projects. However, this package has been found to contain malicious code that compromises the security of any system where it is installed.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the pulse-rsvp-card-entity package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it embeds harmful functionalities that can lead to severe security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pulse-rsvp-card-entityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that the pulse-rsvp-card-entity package is uninstalled from your project. You can do this by running the following command: npm uninstall pulse-rsvp-card-entity. Additionally, monitor your system for any unusual activity and consider using security tools to scan for remaining threats.
Conclusion
The pulse-rsvp-card-entity package contains malicious code that poses a significant security risk. Users are advised to uninstall the package immediately and take necessary precautions to secure their systems. Regular monitoring and the use of tools like Vulert can help in identifying and mitigating such vulnerabilities.
See every vulnerability recorded for pulse-rsvp-card-entity →
FAQ
It is an npm library used to integrate RSVP card functionalities into web applications.
The malicious code compromises the security of the system, allowing unauthorized access to sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the package and rotate any secrets or keys stored on the affected system.
Currently, there is no patch available. The recommended action is to remove the package and secure your system.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
