Critical Malicious Code Vulnerability in silgi Package
Summary
MAL-2025-191425: Malicious code in silgi (npm). Affects silgi versions 0.43.30. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The silgi package is an npm library designed for various utility functions in JavaScript applications. It is widely used for its simplicity and effectiveness in streamlining development processes. However, it has recently been compromised, exposing users to severe security risks due to malicious code embedded within the package.
Vulnerability Detail
The vulnerability originates from a compromise by the Sha1-Hulud: The Second Coming NPM worm, which has infected the silgi package. This malicious payload is designed to steal tokens and credentials from users and publish them to GitHub. Additionally, the worm can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. The potential ramifications include unauthorized access to sensitive information and the destruction of the user's home directory.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall silgiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the silgi package from their project until a secure version is confirmed. Use the following command to uninstall the package: npm uninstall silgi.
Conclusion
The silgi package has been compromised by a malicious worm, posing significant security risks to users. It is crucial to update to the latest version and monitor your applications for vulnerabilities to protect sensitive information.
See every vulnerability recorded for silgi →
FAQ
The silgi package is an npm library that provides utility functions for JavaScript applications, helping developers streamline their coding processes.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without any signup.
If you have installed the compromised version, you should immediately uninstall it and update to the latest patched version to mitigate the risks.
The risks include unauthorized access to sensitive tokens and credentials, potential data breaches, and the possibility of the worm propagating to other packages.
To prevent future vulnerabilities, regularly monitor your dependencies for updates, use tools like Vulert for real-time alerts, and review the security practices of the packages you use.
