Critical Malicious Code Vulnerability in tenacious-fetch Package
Summary
MAL-2025-191023: Malicious code in tenacious-fetch (npm). Affects tenacious-fetch versions 2.3.2 – 2.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tenacious-fetch package is a JavaScript library used in Node.js applications for making HTTP requests with enhanced retry capabilities. It is designed to simplify the process of fetching resources while providing resilience against transient failures. However, recent findings have revealed that this package contains malicious code, posing significant security risks to any system that utilizes it.
Vulnerability Detail
The vulnerability originates from the discovery of embedded malicious code within the tenacious-fetch package. This code can compromise the integrity of the host system, allowing unauthorized access and control to external entities. Systems running versions 2.3.2 and 2.3.3 of this package are particularly at risk. The ramifications include potential data breaches, loss of sensitive information, and complete system compromise, necessitating immediate action from affected users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tenacious-fetchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages that provide similar functionality without the associated risks. Additionally, ensure that your system is monitored for any unusual activity following the removal of the package.
Conclusion
The tenacious-fetch package has been identified as containing malicious code, posing severe risks to systems that utilize it. Immediate removal and security measures are essential to mitigate potential damage. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for tenacious-fetch →
FAQ
tenacious-fetch is a JavaScript library for Node.js that simplifies making HTTP requests with built-in retry mechanisms.
If you have installed versions 2.3.2 or 2.3.3 of the tenacious-fetch package, your system is likely compromised. You can use Vulert to check your application for vulnerabilities.
Immediately remove the tenacious-fetch package and rotate any sensitive information stored on the affected system.
Due to the discovery of malicious code, it is advisable to avoid using the tenacious-fetch package until a thorough review and patching have been confirmed.
Vulert monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities, helping you maintain the security of your software.
