Critical Malicious Code Vulnerability in tavily-module Package
Summary
MAL-2025-191432: Malicious code in tavily-module (npm). Affects tavily-module versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tavily-module is an npm package designed for specific functionalities within JavaScript applications. It is commonly used for various tasks in web development. However, it has recently been compromised, leading to severe security vulnerabilities that can affect any system where it is installed.
Vulnerability Detail
The tavily-module package has been compromised by a malicious payload known as the Sha1-Hulud: The Second Coming NPM worm. This vulnerability allows the worm to steal tokens and credentials, publishing them to GitHub. It can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. Additionally, there is a risk that the worm may destroy the user's home directory, leading to significant data loss and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tavily-moduleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is advised to uninstall the tavily-module package using the command: npm uninstall tavily-module. However, be aware that simply removing the package may not eliminate all malicious software that has been installed as a result of the compromise.
Conclusion
The tavily-module package has been compromised, posing a significant risk to systems where it is installed. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for tavily-module →
FAQ
The tavily-module is an npm package used in JavaScript applications for various functionalities, but it has been compromised, leading to security vulnerabilities.
The malicious payload can steal sensitive tokens and credentials, publish them to GitHub, and potentially destroy your home directory.
If you have the tavily-module installed, you should uninstall it immediately and rotate any secrets or keys stored on your computer.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
No, uninstalling the tavily-module may not remove all malicious software that has been installed. It is essential to take further security measures.
