Critical Malicious Code Vulnerability in rce-pkg-2 Package
Summary
MAL-2026-1834: Malicious code in rce-pkg-2 (npm). Affects rce-pkg-2 versions 1.0.0 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rce-pkg-2 is an npm package designed for remote code execution tasks, allowing developers to execute code remotely in a controlled environment. However, this package has been identified to contain malicious code that can compromise the security of applications utilizing it. The vulnerability affects versions 1.0.0 and 1.1.0, making it crucial for users to be aware of its implications.
Vulnerability Detail
The vulnerability in rce-pkg-2 stems from the inclusion of malicious code that can execute unauthorized commands on the host system. This can lead to severe consequences, including data breaches, unauthorized access to sensitive information, and potential system compromise. The malicious code was identified by ReversingLabs and is documented in the Open Source Vulnerability database, highlighting the importance of scrutinizing third-party packages before integration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rce-pkg-2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the rce-pkg-2 package from your project until a secure version is released. You can do this by running:
npm uninstall rce-pkg-2
This will help mitigate the risk of exploitation while you await a fix.
Conclusion
The rce-pkg-2 package has been found to contain malicious code that can severely compromise application security. It is essential for developers to update to a patched version or remove the package entirely until a fix is available. Regular monitoring of dependencies using tools like Vulert can help maintain security in your projects.
See every vulnerability recorded for rce-pkg-2 →
FAQ
The vulnerability involves malicious code that can execute unauthorized commands on the host system, posing a significant security risk.
Versions 1.0.0 and 1.1.0 of rce-pkg-2 are known to be affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider removing the package from your project as a temporary measure to mitigate risks.
The vulnerability was identified by ReversingLabs, a security research organization specializing in malware analysis.
