Malicious Code Injection in tostpro Package: npm Vulnerability Summary
Summary
MAL-2026-17564: Malicious code in tostpro (npm). Affects tostpro versions 100.2.0 – 100.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tostpro package is an npm module designed for various utility functions in JavaScript applications. It is commonly used for its simplicity and ease of integration. However, version 100.2.0 of tostpro has been found to contain a malicious preinstall script that compromises the security of systems using it.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle hook in the tostpro package, specifically in version 100.2.0. This hook executes a script (test.sh) during the npm install process, which constructs a command to send sensitive environment data to a remote server (https://abbishal.com/sh/poc). The script obfuscates its actions by using single-letter variables and includes a time-based gate that activates the malicious behavior after a specific Unix timestamp. This poses a significant risk as it can expose CI tokens, cloud credentials, and API keys, leading to potential data breaches and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tostproIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tostpro package altogether until you can update to the patched version. If you must use it, consider isolating the installation in a controlled environment where sensitive data is not present.
Conclusion
The tostpro package version 100.2.0 contains a serious vulnerability due to a malicious preinstall script that can expose sensitive data. It is crucial to update to version 100.6.0 or implement workarounds to mitigate risks. Regular monitoring of open-source dependencies is recommended to maintain security.
See every vulnerability recorded for tostpro →
FAQ
The vulnerability involves a malicious preinstall script that sends sensitive environment data to a remote server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider isolating the installation or removing the package until a secure version is available.
Failing to address this vulnerability can lead to exposure of sensitive information, unauthorized access to systems, and potential data breaches.
You can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json.
