Malicious Code Exfiltration in sorrawit-dev-helper Package
Summary
MAL-2026-16344: Malicious code in sorrawit-dev-helper (npm). Affects sorrawit-dev-helper versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sorrawit-dev-helper package is an npm utility designed to assist developers with various tasks in their development environment. However, it has been found to contain malicious code that exploits the postinstall lifecycle script to exfiltrate sensitive data from the user's machine. This vulnerability poses a significant risk to users who install the package, as it can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability originates from a postinstall lifecycle script declared in the package.json file of sorrawit-dev-helper. When a user installs the package using npm, this script automatically executes, reading the contents of /tmp/flag.txt from the installer's machine. It then sends this data to a hardcoded ngrok tunnel, which is an ephemeral tunnel host controlled by an attacker. This behavior constitutes a clear case of install-time credential and file exfiltration, as it occurs without any user interaction and targets a specific data source on the user's machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sorrawit-dev-helperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the sorrawit-dev-helper package altogether until a secure version is released. Additionally, consider using a package monitoring tool like Vulert to keep track of vulnerabilities in your dependencies. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The sorrawit-dev-helper package contains a serious vulnerability that allows for the exfiltration of sensitive data from users' machines. It is essential to uninstall this package and monitor your dependencies for vulnerabilities to protect your development environment.
See every vulnerability recorded for sorrawit-dev-helper →
FAQ
sorrawit-dev-helper is an npm package designed to assist developers with various tasks in their development environment.
The vulnerability works by executing a postinstall script that reads sensitive data from the user's machine and sends it to an attacker-controlled URL.
If you have installed the sorrawit-dev-helper package, you should uninstall it immediately using the command: npm uninstall sorrawit-dev-helper.
Yes, you can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
Yes, you can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
