Malicious Code Vulnerability in test-supply-npm-lib-4: A Security Risk for npm Users
Summary
MAL-2026-17314: Malicious code in test-supply-npm-lib-4 (npm). Affects test-supply-npm-lib-4 versions 3.3.3 – 3.3.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
test-supply-npm-lib-4 is an npm package designed to facilitate certain functionalities within JavaScript applications. It is commonly used for managing dependencies and enhancing the development workflow. However, this package has been found to contain a vulnerability that allows for the execution of malicious code during installation, posing a significant security risk to users who rely on it.
Vulnerability Detail
The vulnerability arises from the package.json file of test-supply-npm-lib-4, which declares a dependency sourced from a GitHub URL rather than the npm registry. This dependency is linked to an individual GitHub account, which is not associated with any established publisher. When users run 'npm install', the package manager clones the GitHub repository and executes any lifecycle scripts, including potentially harmful code. This means that whoever controls the GitHub repository can execute arbitrary code on the installer's machine, leading to severe security implications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall test-supply-npm-lib-4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the vulnerable version of test-supply-npm-lib-4 by manually checking the package's dependencies and opting for a safer alternative or by removing the package from their project until a fix is available.
Conclusion
The discovery of malicious code in the test-supply-npm-lib-4 package highlights the importance of verifying dependencies sourced from external repositories. Users are encouraged to update their packages regularly and utilize tools like Vulert to monitor vulnerabilities effectively.
See every vulnerability recorded for test-supply-npm-lib-4 →
FAQ
The vulnerability allows for the execution of malicious code during the installation of the package due to its dependency being sourced from an unverified GitHub repository.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If an immediate update is not possible, consider removing the package or using an alternative library until a secure version is released.
While the primary risk is the execution of malicious code, it is advisable to review your system for any unauthorized changes or data loss after installing the vulnerable version.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities, providing an easy way to stay informed about potential risks.
