Critical Malicious Code Vulnerability in Sturdyfetch17 Package
Summary
MAL-2025-192867: Malicious code in sturdyfetch17 (npm). Affects sturdyfetch17 versions 0.30.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sturdyfetch17 is an npm package designed for fetching resources in a robust manner. It is utilized in various applications for its efficient handling of network requests. However, it has been identified as having a critical vulnerability that allows for the execution of malicious code, potentially compromising the integrity of applications that depend on it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within version 0.30.1 of the sturdyfetch17 package. This code can execute unauthorized actions within the user's environment, leading to data breaches, unauthorized access, and other security risks. The issue was reported by ReversingLabs and is cataloged under the ID MAL-2025-192867, highlighting the importance of immediate action to mitigate potential damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sturdyfetch17If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the sturdyfetch17 package until a secure version is released. Alternatively, consider using a different package that provides similar functionality without the associated risks.
Conclusion
The sturdyfetch17 package has been identified with a critical vulnerability due to malicious code. Immediate action is required to update the package or implement workarounds to protect applications from potential threats. Regular monitoring and using tools like Vulert can help maintain security in open-source dependencies.
See every vulnerability recorded for sturdyfetch17 →
FAQ
The vulnerability involves malicious code that can execute unauthorized actions, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider using alternative packages or temporarily halting the use of sturdyfetch17.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
Currently, the vulnerability is associated with version 0.30.1 of sturdyfetch17. Check the package repository for any updates or patches.
