Critical Malicious Code Vulnerability in terser-js Package
Summary
MAL-2026-206: Malicious code in terser-js (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
terser-js is a popular JavaScript parser, mangler, and compressor toolkit used in web development to optimize JavaScript code for production. It is widely adopted due to its efficiency and ability to reduce file sizes, enhancing load times and performance. However, recent findings have revealed that the package has been compromised, leading to severe security risks for users who have it installed.
Vulnerability Detail
The vulnerability in terser-js is classified as malicious code embedded within the package. This issue originated from a compromised version of the package, which allows unauthorized access to any computer running it. The ramifications are significant, as it can lead to full control of the affected system, potentially exposing sensitive information such as secrets and keys. Users are advised to treat any system with this package installed as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall terser-jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to rotate all secrets and keys stored on the affected computer from a different, secure machine. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the terser-js package poses a significant threat to users. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor their systems and consider alternative solutions until a secure version is released.
See every vulnerability recorded for terser-js →
FAQ
The malicious code allows unauthorized access to the system, potentially compromising sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Immediately rotate all secrets and keys from a secure machine to prevent unauthorized access.
Currently, there is no patch available, and the recommendation is to remove the package entirely.
Failure to address this vulnerability can lead to unauthorized access, data breaches, and potential control over your system by malicious actors.
