Malicious Code Detected in shakti-strings Package - Version 1.4.0
Summary
MAL-2026-2003: Malicious code in shakti-strings (npm). Affects shakti-strings versions 1.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shakti-strings package is an npm library designed for string manipulation and processing in JavaScript applications. It provides various utilities for handling strings efficiently. However, version 1.4.0 of this package has been flagged for containing malicious code that communicates with a domain linked to harmful activities, posing a security risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the shakti-strings package arises from its malicious behavior, specifically its communication with a domain associated with malicious activities. This could lead to data exfiltration, unauthorized access, or other security breaches within applications that depend on this package. The OpenSSF Package Analysis project identified this issue, marking the package as malicious due to its potential to compromise application integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shakti-stringsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the shakti-strings package altogether and seek alternative libraries that provide similar functionality without the associated risks. Additionally, ensure that your application is monitored for any suspicious activity.
Conclusion
The shakti-strings package version 1.4.0 has been identified as malicious due to its communication with a harmful domain. It is crucial for developers to update or replace this package to protect their applications from potential security threats. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for shakti-strings →
FAQ
shakti-strings is an npm package used for string manipulation in JavaScript applications.
Version 1.4.0 is flagged as malicious because it communicates with a domain linked to harmful activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should uninstall the affected version and install a secure alternative or the latest version of the package.
Yes, there are several other libraries available for string manipulation in JavaScript, such as lodash or string.js, which do not have known vulnerabilities.
