Critical Malicious Code Vulnerability in supportgameapp Package
Summary
MAL-2026-1970: Malicious code in supportgameapp (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The supportgameapp package is a Node.js library designed for enhancing gaming applications by providing various support functionalities. However, it has been identified as containing malicious code that compromises the security of any system where it is installed. This vulnerability poses a significant risk to developers and users alike, as it can lead to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the supportgameapp package. This code can fully compromise any computer that has the package installed, allowing external entities to gain control over the system. The ramifications include potential theft of sensitive information, unauthorized access to systems, and the installation of additional malicious software. The technical aspect of this vulnerability is classified under CWE-506, indicating that the product contains embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall supportgameappIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that you do not run any applications that depend on the supportgameapp package. If you have already installed it, remove it using the following command in your terminal: npm uninstall supportgameapp. After removal, verify that no residual malicious software remains on your system.
Conclusion
The supportgameapp package contains critical malicious code that poses a severe security risk to any system where it is installed. Immediate removal of the package and rotation of sensitive information is necessary to mitigate the threat. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their projects.
See every vulnerability recorded for supportgameapp →
FAQ
The supportgameapp package is a Node.js library designed to provide support functionalities for gaming applications.
The malicious code can fully compromise your system, allowing unauthorized access and potential theft of sensitive information.
You should immediately uninstall the supportgameapp package and rotate any sensitive keys or secrets stored on the affected system.
No, there is currently no patched version of the supportgameapp package available. The only solution is to remove it completely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
