Malicious Code Vulnerability in smm-yt Package
Summary
MAL-2026-1850: Malicious code in smm-yt (npm). Affects smm-yt versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The smm-yt package is a Node.js library designed for social media management, specifically for automating tasks related to YouTube. It provides functionalities such as video management, analytics, and engagement tracking. However, this package has been identified to contain malicious code that can compromise user systems.
Vulnerability Detail
The vulnerability in the smm-yt package stems from the inclusion of malicious code that can execute unauthorized actions on the user's system. This code can potentially lead to data theft, unauthorized access to user accounts, or even system compromise. The malicious nature of this code was identified by ReversingLabs, which reported the issue on March 18, 2026. The affected version is 1.0.0, and users are advised to take immediate action to mitigate risks associated with this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall smm-ytIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the smm-yt package until a secure version is released. Additionally, consider using alternative packages for social media management that have been vetted for security.
Conclusion
The smm-yt package has been identified to contain malicious code that poses significant risks to users. It is crucial to take immediate action by uninstalling the affected version and seeking alternatives. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for smm-yt →
FAQ
smm-yt is a Node.js library used for managing social media tasks related to YouTube.
The malicious code can execute unauthorized actions, potentially leading to data theft or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
You should uninstall the affected version (1.0.0) and look for a secure alternative or patched version.
The vulnerability was reported by ReversingLabs on March 18, 2026.
