Critical Malicious Code Vulnerability in shelf-jwt-sessions Package
Summary
MAL-2025-191423: Malicious code in shelf-jwt-sessions (npm). Affects shelf-jwt-sessions versions 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shelf-jwt-sessions package is an npm module designed to manage JSON Web Tokens (JWT) for session handling in web applications. It provides developers with a straightforward way to implement authentication and authorization features. However, this package has been compromised, making it susceptible to severe security risks that can affect users' data integrity and privacy.
Vulnerability Detail
The vulnerability originates from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from users and publish them to GitHub. It can also propagate itself to other npm packages owned by the user and establish persistence through a GitHub action. The malicious payload poses a significant risk as it may also lead to the destruction of the user's home directory, resulting in data loss and further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shelf-jwt-sessionsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the shelf-jwt-sessions package from your project until a secure version is released. You can do this by running: npm uninstall shelf-jwt-sessions. Additionally, monitor your project for any unauthorized access or changes.
Conclusion
The shelf-jwt-sessions package has been compromised by a malicious worm, leading to severe security vulnerabilities. It is essential to take immediate action by updating or removing the package to protect your application and user data. Regular monitoring and using tools like Vulert can help ensure your application remains secure.
See every vulnerability recorded for shelf-jwt-sessions →
FAQ
The shelf-jwt-sessions package is used for managing JSON Web Tokens (JWT) in web applications, facilitating user authentication and session management.
The malicious code can steal sensitive tokens and credentials, potentially leading to unauthorized access to your application and data breaches.
Immediately uninstall the compromised version and monitor your application for any suspicious activity. Update to a secure version as soon as it is available.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Failure to address this vulnerability can lead to data theft, unauthorized access, and potential destruction of your application’s data, resulting in significant operational and reputational damage.
