Malicious Code Detected in ssf-desktop-api-browser: Version 99.99.2 Compromised
Summary
MAL-2025-192359: Malicious code in ssf-desktop-api-browser (npm). Affects ssf-desktop-api-browser versions 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ssf-desktop-api-browser' is an npm package designed for desktop applications, providing APIs for seamless integration with web technologies. It is widely used for developing cross-platform applications. However, version 99.99.2 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in 'ssf-desktop-api-browser' arises from its communication with a domain linked to malicious activities and the execution of commands that can lead to harmful consequences. This behavior poses significant risks, including unauthorized access to sensitive data and potential system compromise. The identification of this malicious activity was made by the OpenSSF Package Analysis project, which monitors and evaluates package safety.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ssf-desktop-api-browserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'ssf-desktop-api-browser' package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall ssf-desktop-api-browser.
Conclusion
The 'ssf-desktop-api-browser' package version 99.99.2 has been identified as malicious, posing significant security risks. Users are advised to update or uninstall the package to protect their applications. Utilizing tools like Vulert can help monitor vulnerabilities effectively.
See every vulnerability recorded for ssf-desktop-api-browser →
FAQ
The package communicates with a domain associated with malicious activities and executes harmful commands.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the package-lock.json file. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider uninstalling the package until a secure version is available to prevent potential risks.
The vulnerability was identified by the OpenSSF Package Analysis project, which specializes in evaluating the safety of open-source packages.
Currently, version 99.99.2 is specifically flagged as malicious. It is advisable to monitor updates from the package maintainers for further information.
