Critical Security Breach in selenium-session-client: Malicious Code Injection
Summary
MAL-2025-191422: Malicious code in selenium-session-client (npm). Affects selenium-session-client versions 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The selenium-session-client is an npm package designed to facilitate the management of Selenium sessions in web automation tasks. It provides developers with tools to create, manage, and terminate Selenium sessions efficiently. However, this package has been compromised, making it vulnerable to severe security threats that can affect users' credentials and system integrity.
Vulnerability Detail
The vulnerability originates from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from users, subsequently publishing this sensitive information to GitHub. Additionally, it can propagate itself to other npm packages owned by the user and establish persistence through a GitHub action. The malicious code poses a significant risk as it may also lead to the destruction of the user's home directory, compromising both data and system security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall selenium-session-clientIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should consider removing the compromised package from their project and avoid using it until a secure version is released. You can remove the package using the following command: npm uninstall selenium-session-client.
Conclusion
The selenium-session-client package has been compromised by a malicious worm that poses significant security risks to users. Immediate action is required to update or remove the package to safeguard sensitive information and maintain system integrity. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for selenium-session-client →
FAQ
The primary risk is the theft of sensitive tokens and credentials, which can lead to unauthorized access to user accounts and data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you suspect that you have been compromised, immediately change your credentials and review your security settings. Consider consulting a security professional.
Regularly update your dependencies, use tools like Vulert for monitoring vulnerabilities, and conduct security audits on your codebase.
If the worm propagates to other npm packages, it can compromise additional projects, leading to widespread security issues across multiple applications.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.