Malicious Code Vulnerability in tierlist Package
Summary
MAL-2025-192880: Malicious code in tierlist (npm). Affects tierlist versions 1.0.0 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tierlist package is a Node.js library commonly used in web development to create and manage tier lists. It allows users to easily categorize items and share their rankings. However, recent findings have revealed that certain versions of this package contain malicious code that can compromise user systems.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the tierlist package, specifically in versions 1.0.0, 1.0.1, and 1.0.2. This code can execute harmful actions on the user's machine, potentially leading to data theft or system compromise. The issue was identified by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tierlistIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, users can remove the tierlist package from their project until a secure version is confirmed. This can be done by executing the command: npm uninstall tierlist.
Conclusion
The tierlist package has been found to contain malicious code in specific versions, posing a significant risk to users. It is crucial to update to the latest version or remove the package until a secure version is confirmed. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for tierlist →
FAQ
Versions 1.0.0, 1.0.1, and 1.0.2 of the tierlist package are affected by the malicious code vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If immediate updates are not possible, consider removing the tierlist package from your project as a temporary measure until a secure version is available.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection and analysis.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
