Malicious Code Detected in test_pkg_forppe: npm Package Vulnerability
Summary
MAL-2026-1423: Malicious code in test_pkg_forppe (npm). Affects test_pkg_forppe versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'test_pkg_forppe' is an npm package designed for testing purposes. It is intended to facilitate various testing scenarios within JavaScript applications. However, this package has been flagged for malicious behavior, which poses significant risks to users who may unknowingly integrate it into their projects.
Vulnerability Detail
The vulnerability in 'test_pkg_forppe' stems from its ability to communicate with a domain linked to malicious activities. Furthermore, it executes commands that are associated with harmful behavior, potentially compromising the security of the host system. This vulnerability was identified by the OpenSSF Package Analysis project, which monitors and evaluates the safety of open-source packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall test_pkg_forppeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative testing packages that do not exhibit malicious behavior. Always review the package's reputation and community feedback before integrating it into your project.
Conclusion
The 'test_pkg_forppe' npm package has been identified as malicious, posing significant risks to users. It is crucial to uninstall this package and consider safer alternatives to protect your applications from potential threats. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for test_pkg_forppe →
FAQ
The package communicates with a domain associated with malicious activities and executes harmful commands.
You can use the Vulert playground at Vulert Scanner to monitor and check for vulnerabilities in your application without requiring any signup.
There is no patch available for 'test_pkg_forppe'; the best course of action is to uninstall the package.
Uninstall the package immediately and consider using safer alternatives for your testing needs.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities in your software.
