Critical Malicious Code Vulnerability in rhlozh Package
Summary
MAL-2026-18035: Malicious code in rhlozh (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rhlozh package is an npm library that is utilized in various JavaScript applications for specific functionalities. However, it has been identified as containing malicious code, which poses a significant security risk to any system where it is installed. The presence of this vulnerability can lead to unauthorized access and control over the affected systems, compromising sensitive data and secrets.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the rhlozh package. This code can fully compromise any computer that has the package installed, allowing attackers to gain control over the system. The ramifications include potential data breaches, unauthorized access to sensitive information, and the installation of additional malicious software. The vulnerability is classified under CWE-506, indicating that the product contains embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rhlozhIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that you do not run any applications that depend on the rhlozh package until it has been completely removed from your system. Regularly monitor your system for any signs of unauthorized access or malicious activity.
Conclusion
The rhlozh package has been identified as containing malicious code that compromises the security of any system where it is installed. Immediate removal of the package and rotation of sensitive information is essential to mitigate the risks associated with this vulnerability. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for rhlozh →
FAQ
The rhlozh package is an npm library used in JavaScript applications, but it has been compromised with malicious code.
If you have the rhlozh package installed, your system is considered compromised. You should take immediate action to remove it.
After removal, rotate all secrets and keys stored on the affected computer from a secure machine to prevent unauthorized access.
No, there is currently no patched version of the rhlozh package available. The only solution is to uninstall it.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
