Critical Malware Threat in serpacksven Package: Embedded Malicious Code Detected
Summary
MAL-2026-17625: Malicious code in serpacksven (npm). Affects serpacksven versions 1.0.0 – 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The serpacksven package is an npm library that is intended for JavaScript functionality. However, it has been found to contain malicious code that compromises the security of systems using it. This package lacks a functional main entry point, rendering it non-operational as a legitimate library, and instead includes an obfuscated PowerShell script that poses significant security risks.
Vulnerability Detail
The vulnerability originates from the inclusion of a heavily obfuscated PowerShell script within the package. This script hides its execution from the user, performs various anti-analysis techniques, and ultimately loads a .NET assembly that is controlled by an attacker. The presence of this malicious code means that any system running this package is at risk of being fully compromised, with potential exposure of sensitive information and unauthorized access to the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall serpacksvenIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid executing any scripts or commands that may invoke the json.txt file included in the package. Additionally, consider using a tool like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without needing to sign up.
Conclusion
The discovery of malicious code within the serpacksven package highlights the importance of vigilance when using open-source libraries. Users must take immediate action to remove the package and secure their systems. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for serpacksven →
FAQ
serpacksven is an npm package intended for JavaScript functionality, but it has been identified as containing malicious code.
The malicious code is an obfuscated PowerShell script that hides its execution and loads a .NET assembly controlled by an attacker.
You should immediately remove the serpacksven package from your project and rotate any sensitive information stored on the affected system.
While many npm packages are safe, it is crucial to monitor for vulnerabilities and verify the integrity of packages before installation.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your package-lock.json file.
