Malicious Code Detected in showdownxss Package - Security Alert
Summary
MAL-2026-23: Malicious code in showdownxss (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The showdownxss package is a JavaScript library designed for converting Markdown into HTML. It is commonly used in web applications to facilitate the rendering of user-generated content. However, this package has been found to contain malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the showdownxss package originates from the presence of malicious code that can compromise the security of applications using this library. This malicious code can lead to unauthorized access, data breaches, or the execution of harmful scripts within the application context. The issue was identified by Amazon Inspector, highlighting the importance of scrutinizing third-party packages for security flaws.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall showdownxssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the showdownxss package from your project and replacing it with a more secure alternative for Markdown processing. This can help mitigate the risk until a proper fix is applied.
Conclusion
The showdownxss package has been identified as containing malicious code that poses a significant risk to applications. It is crucial to update the package to a secure version or consider alternatives to safeguard your application from potential threats.
See every vulnerability recorded for showdownxss →
FAQ
showdownxss is a JavaScript library that converts Markdown into HTML, commonly used in web applications.
The malicious code can lead to unauthorized access and data breaches, posing a significant security risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider removing the showdownxss package and using a more secure alternative for Markdown processing as a temporary measure.
The vulnerability was identified by Amazon Inspector, which monitors open-source packages for security issues.
