Malicious Code Detected in tescoutils Package - Security Alert
Summary
MAL-2025-192879: Malicious code in tescoutils (npm). Affects tescoutils versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tescoutils package is a utility library designed for various tasks in JavaScript applications. It is commonly used in npm-based projects for its convenience and ease of integration. However, recent findings have revealed that specific versions of this package contain malicious code that could compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability originates from malicious code embedded in versions 1.0.0 and 1.0.1 of the tescoutils package. This code can lead to unauthorized access, data breaches, or other malicious activities within applications that rely on this package. The presence of such code poses significant risks to developers and users, as it can exploit application vulnerabilities and potentially lead to severe consequences.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tescoutilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tescoutils package from your project until a secure version is released. Use the following command to uninstall it: 'npm uninstall tescoutils'. This will prevent any potential exploitation while you await a fix.
Conclusion
The discovery of malicious code in the tescoutils package highlights the importance of regularly updating dependencies and monitoring for vulnerabilities. Developers should take immediate action to secure their applications by updating or removing the affected package.
See every vulnerability recorded for tescoutils →
FAQ
tescoutils is a utility library for JavaScript applications, commonly used in npm projects for various tasks.
Versions 1.0.0 and 1.0.1 of the tescoutils package contain the malicious code.
You should update to a patched version of the tescoutils package as soon as possible to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Using the affected package can lead to unauthorized access, data breaches, and other malicious activities that compromise your application's security.
