Malicious Code Detected in security-testing-research99: A Critical npm Vulnerability
Summary
MAL-2025-192860: Malicious code in security-testing-research99 (npm). Affects security-testing-research99 versions 1.0.6 – 1.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
security-testing-research99 is an npm package designed for security testing and research purposes. It provides tools and functionalities that assist developers and security professionals in identifying vulnerabilities within their applications. However, this package has been compromised, leading to the introduction of malicious code that can potentially harm users and their systems.
Vulnerability Detail
The vulnerability in security-testing-research99 stems from the inclusion of malicious code within its versions 1.0.6, 1.0.7, and 1.0.8. This code can execute harmful actions on the user's system, potentially leading to data breaches, unauthorized access, or system instability. The malicious nature of this code poses significant risks to any application that utilizes this package, making it imperative for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall security-testing-research99If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can consider removing the security-testing-research99 package from their project until a secure version is released. This can be done by executing the following command: npm uninstall security-testing-research99. Alternatively, users can explore other security testing packages that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the security-testing-research99 npm package highlights the importance of vigilance in managing open-source dependencies. Users are strongly advised to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for security-testing-research99 →
FAQ
The malicious code can execute harmful actions on the user's system, leading to potential data breaches and unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions 1.0.6, 1.0.7, and 1.0.8 of security-testing-research99 are known to contain the malicious code.
Yes, users should update to the latest version of security-testing-research99 to mitigate the risks associated with this vulnerability.
If immediate updates are not possible, consider uninstalling the package or using alternative security testing tools until a secure version is available.
