Malicious Code Detected in tnaparserxml Package - Security Alert
Summary
MAL-2025-192465: Malicious code in tnaparserxml (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tnaparserxml package is a Node.js library used for parsing XML data. It is designed to facilitate the handling and manipulation of XML files within JavaScript applications. However, the package has been identified as containing malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the tnaparserxml package, which has been flagged for containing malicious code. This code can potentially compromise the security of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. The issue was identified by Amazon Inspector, highlighting the importance of scrutinizing third-party packages for security vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tnaparserxmlIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative XML parsing libraries that are known to be secure, such as xml2js or fast-xml-parser. You can install one of these packages using npm: 'npm install xml2js' or 'npm install fast-xml-parser'.
Conclusion
The tnaparserxml package has been identified as containing malicious code, posing a significant risk to applications that utilize it. It is crucial to uninstall this package and consider secure alternatives to protect your application from potential threats. Regular monitoring and updating of dependencies are essential for maintaining application security.
See every vulnerability recorded for tnaparserxml →
FAQ
The tnaparserxml package is used for parsing XML data in Node.js applications, allowing developers to manipulate XML files easily.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without any signup.
If you have used tnaparserxml in your project, it is recommended to uninstall the package immediately and replace it with a secure alternative.
Currently, there is no patched version available for tnaparserxml. The best course of action is to remove the package and use a different XML parsing library.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and keep your packages updated.
