Critical Malicious Code Vulnerability in shell-exec Package
Summary
MAL-2025-191424: Malicious code in shell-exec (npm). Affects shell-exec versions 1.1.3 – 1.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shell-exec package is a Node.js library that allows users to execute shell commands from within JavaScript code. It is commonly used in various applications for automating tasks and managing system processes. However, this package has been compromised, introducing a severe vulnerability that can lead to unauthorized access and control over affected systems.
Vulnerability Detail
The vulnerability originates from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm steals tokens and credentials, publishing them to GitHub, and propagates itself to NPM packages owned by the user. It also establishes persistence through GitHub actions and may even destroy the user's home directory. Any system with the compromised package installed is considered fully compromised, necessitating immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shell-execIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the compromised package and ensuring that your system is secure. It is recommended to monitor your system for any unauthorized access or changes.
Conclusion
The shell-exec package has been compromised by a malicious worm, posing serious risks to any system using it. Immediate removal of the package and rotation of sensitive credentials are essential steps to mitigate the impact of this vulnerability. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for shell-exec →
FAQ
You should immediately uninstall the shell-exec package and rotate any credentials or tokens that may have been compromised.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to your system, potential data loss, and the compromise of sensitive information.
Currently, there are no patched versions available for the compromised shell-exec package. The best course of action is to remove it entirely.
The worm propagates by infecting NPM packages owned by the user and establishing persistence through GitHub actions, making it a significant threat.
