Malicious Code Detected in remark-parse10: A Critical Security Alert
Summary
MAL-2025-192246: Malicious code in remark-parse10 (npm). Affects remark-parse10 versions 10.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
remark-parse10 is an npm package designed for parsing Markdown using the Remark ecosystem. It is widely used in JavaScript applications to convert Markdown content into HTML. However, the package has been identified with a serious vulnerability that allows malicious code execution, posing significant risks to applications that rely on it.
Vulnerability Detail
The vulnerability in remark-parse10 stems from the presence of malicious code that communicates with a domain linked to harmful activities. This code can execute commands that may compromise the security of the host application, leading to potential data breaches or unauthorized access. The malicious nature of the package was confirmed by both Amazon Inspector and the OpenSSF Package Analysis project, which flagged version 10.0.2 as particularly dangerous.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall remark-parse10If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider temporarily removing the remark-parse10 package from your project and replacing it with an alternative Markdown parsing library until a secure version is released.
Conclusion
The discovery of malicious code in the remark-parse10 package highlights the importance of regularly monitoring and updating dependencies in software projects. Users of this package should take immediate action to mitigate risks by updating to a secure version or considering alternative solutions.
See every vulnerability recorded for remark-parse10 →
FAQ
The malicious code communicates with a domain associated with harmful activities and executes commands that can compromise application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file to check for vulnerabilities.
As a temporary measure, consider removing the remark-parse10 package and using an alternative Markdown parsing library until a secure version is available.
The vulnerability was reported by Amazon Inspector and the OpenSSF Package Analysis project, both of which identified the package as malicious.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any code or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
