Malicious Code Detected in sharedclasses Package: Version 1.0.1 Vulnerability
Summary
MAL-2026-612: Malicious code in sharedclasses (npm). Affects sharedclasses versions 1.0.1 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'sharedclasses' package is an npm library designed for sharing classes across different modules in JavaScript applications. It aims to streamline the development process by providing reusable components. However, version 1.0.1 has been flagged for malicious behavior, which compromises its integrity and poses security risks to users.
Vulnerability Detail
The vulnerability in the 'sharedclasses' package arises from its communication with a domain linked to malicious activities and the execution of commands that can lead to harmful behavior. This can result in unauthorized access to sensitive data, system compromise, and potential exploitation by attackers. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which flagged it due to its harmful interactions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sharedclassesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider removing it from your project or replacing it with a safer alternative until you can apply the fix.
Conclusion
The 'sharedclasses' package version 1.0.1 has been identified as malicious, posing significant security risks. It is crucial for developers using this package to update to version 1.0.2 or remove it from their projects to mitigate potential threats.
See every vulnerability recorded for sharedclasses →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that can lead to harmful consequences.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Consider removing the 'sharedclasses' package from your project or replacing it with a safer alternative until you can apply the update.
The vulnerability was identified by the OpenSSF Package Analysis project, which flagged the 'sharedclasses' package as malicious due to its harmful interactions.
Using the compromised version can lead to unauthorized access to sensitive data, system compromise, and exploitation by attackers.
