Malicious Code Vulnerability in Sturdyfetch19 Package
Summary
MAL-2025-192869: Malicious code in sturdyfetch19 (npm). Affects sturdyfetch19 versions 0.30.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sturdyfetch19 is an npm package designed for efficient data fetching and handling in JavaScript applications. It is utilized by developers for its simplicity and performance. However, this package has been identified to contain malicious code that can compromise the security of applications using it, making it crucial for users to be aware of this vulnerability.
Vulnerability Detail
The vulnerability in Sturdyfetch19 stems from the inclusion of malicious code that can execute harmful operations within the user's environment. This issue was reported by ReversingLabs and affects version 0.30.1 of the package. The malicious code can potentially lead to unauthorized access, data breaches, or further exploitation of the system, posing significant risks to users and their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sturdyfetch19If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the Sturdyfetch19 package from your project until a safe version is released. You can do this by executing the command: 'npm uninstall sturdyfetch19'. This will prevent any potential exploitation while you seek an alternative package.
Conclusion
The Sturdyfetch19 package has been identified to contain malicious code that poses a significant security risk to applications using it. Users are advised to update or remove the package to mitigate potential threats. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for sturdyfetch19 →
FAQ
The vulnerability involves malicious code that can execute harmful operations, potentially compromising the security of applications using the package.
Version 0.30.1 of Sturdyfetch19 is known to contain the malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should update the package to the latest version or remove it from your project until a safe version is available.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
