Malicious Code Detected in tna_xmlparser Package - npm Vulnerability
Summary
MAL-2025-192371: Malicious code in tna_xmlparser (npm). Affects tna_xmlparser versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tna_xmlparser package, available on npm, is designed for parsing XML data. It is utilized in various applications that require XML processing. However, the package version 1.0.0 has been flagged for malicious behavior, which raises significant security concerns for users relying on it for safe data handling.
Vulnerability Detail
The vulnerability in the tna_xmlparser package arises from the execution of commands that are associated with malicious behavior. This can lead to unauthorized access, data breaches, or the execution of harmful scripts within the user's environment. The OpenSSF Package Analysis project identified this issue, highlighting the potential risks involved with using this compromised package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tna_xmlparserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tna_xmlparser package and look for alternative libraries that offer XML parsing capabilities without the malicious behavior. Ensure to review the security status of any new package before integrating it into your project.
Conclusion
The tna_xmlparser package has been identified as malicious, posing significant security risks to users. It is essential to uninstall this package and seek safer alternatives to protect your applications from potential threats.
See every vulnerability recorded for tna_xmlparser →
FAQ
The tna_xmlparser package is used for parsing XML data in JavaScript applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you have installed the tna_xmlparser package, it is crucial to uninstall it immediately and look for alternative packages that do not pose security risks.
No, there is no patched version available for the tna_xmlparser package. It is advised to remove it entirely from your project.
Using a malicious package can lead to unauthorized access to your system, data breaches, and the execution of harmful scripts, compromising the security of your application.
