Malicious Code Vulnerability in redirect-clrm2u Package
Summary
MAL-2025-191584: Malicious code in redirect-clrm2u (npm). Affects redirect-clrm2u versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The redirect-clrm2u package is an npm module designed for managing URL redirection in web applications. It provides developers with tools to easily implement redirection logic. However, this package has been identified as containing malicious code that could compromise the security of applications utilizing it. The vulnerability affects version 1.0.0 of the package, making it critical for users to be aware of its implications.
Vulnerability Detail
The vulnerability in the redirect-clrm2u package stems from the inclusion of malicious code that can execute unauthorized actions within the user's environment. This code can lead to data breaches, unauthorized access to sensitive information, and potential exploitation of the application. The malicious nature of this code poses significant risks to both developers and end-users, making it imperative to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall redirect-clrm2uIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the redirect-clrm2u package altogether and implement your own URL redirection logic or use a different, trusted package that provides similar functionality.
Conclusion
The redirect-clrm2u package contains malicious code that poses a significant security risk. Users are advised to uninstall the package and seek alternative solutions for URL redirection to ensure the safety of their applications.
See every vulnerability recorded for redirect-clrm2u →
FAQ
The redirect-clrm2u package is an npm module used for managing URL redirection in web applications.
The vulnerability involves malicious code that can execute unauthorized actions, potentially compromising application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Currently, there is no patched version available for the redirect-clrm2u package. It is recommended to uninstall it.
You should uninstall the redirect-clrm2u package and consider using a secure alternative for URL redirection.
