Malicious Code Detected in signup-failover Package: Version 10.0.1
Summary
MAL-2025-190650: Malicious code in signup-failover (npm). Affects signup-failover versions 10.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'signup-failover' package, available on npm, is designed to manage user sign-up processes with failover capabilities. It aims to enhance user experience by ensuring that sign-up requests are handled efficiently, even in the event of server issues. However, version 10.0.1 of this package has been flagged for malicious activity, raising concerns about its security and integrity.
Vulnerability Detail
The vulnerability in the 'signup-failover' package arises from its communication with a domain linked to malicious activities. This behavior indicates that the package may execute harmful commands, potentially compromising user data and system security. The identification of this malicious behavior was made by the OpenSSF Package Analysis project, which has documented the package's association with malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall signup-failoverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative packages that provide similar functionality without the associated risks. Always ensure to review the security status of any package before integrating it into your project.
Conclusion
The 'signup-failover' package version 10.0.1 has been identified as malicious, posing significant risks to users and their data. It is essential to remove this package from your projects and monitor for updates or patches. Utilizing tools like Vulert can help keep your applications secure by providing real-time vulnerability alerts.
See every vulnerability recorded for signup-failover →
FAQ
The 'signup-failover' package is an npm module designed to manage user sign-up processes, ensuring that requests are handled smoothly even during server issues.
A malicious package is one that contains harmful code or behavior, such as unauthorized data access, communication with harmful domains, or execution of harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
If you are using version 10.0.1 of 'signup-failover', you should uninstall the package immediately and look for alternative solutions until a secure version is released.
The malicious behavior was identified by the OpenSSF Package Analysis project, which specializes in analyzing open-source packages for security vulnerabilities.
