Malicious Code Detected in spire.officejs-common: npm Package Vulnerability
Summary
MAL-2026-39: Malicious code in spire.officejs-common (npm). Affects spire.officejs-common versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'spire.officejs-common' package is a JavaScript library used in web applications, particularly those that interact with Microsoft Office functionalities. It is designed to facilitate the integration of Office features into web applications. However, the package version 1.0.0 has been flagged for malicious behavior, specifically for communicating with domains associated with harmful activities, which poses a significant risk to users and their applications.
Vulnerability Detail
The vulnerability in 'spire.officejs-common' arises from its malicious code that enables communication with a domain linked to malicious activities. This can lead to data breaches, unauthorized access to sensitive information, and potential exploitation of the affected systems. The OpenSSF Package Analysis project identified this issue, highlighting the importance of scrutinizing third-party packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall spire.officejs-commonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, you can temporarily disable the functionality that relies on 'spire.officejs-common' until a secure version is available. Additionally, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The 'spire.officejs-common' package has been identified as malicious due to its communication with harmful domains. Users are urged to remove the affected version and seek alternatives or updates to mitigate potential risks. Utilizing tools like Vulert can enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for spire.officejs-common →
FAQ
The vulnerability involves malicious code that communicates with harmful domains, posing risks such as data breaches and unauthorized access.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
It is advisable to remove the affected version and replace it with a secure alternative or update to a patched version if available.
Yes, consider exploring other libraries that offer similar functionalities without the security risks associated with spire.officejs-common.
Vulert uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities, ensuring your software remains secure.
