Malicious Code Detected in transparent-example-request99: A Critical Security Alert
Summary
MAL-2025-190550: Malicious code in transparent-example-request99 (npm). Affects transparent-example-request99 versions 1.0.2 – 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'transparent-example-request99' is an npm package designed for making HTTP requests in a transparent manner. It is often used by developers to simplify the process of sending requests and handling responses in web applications. However, this package has been identified as malicious due to its ability to communicate with domains associated with harmful activities and execute commands that can compromise system security.
Vulnerability Detail
The vulnerability in 'transparent-example-request99' arises from its malicious behavior, which includes communicating with known malicious domains and executing harmful commands. This can lead to unauthorized access, data breaches, and potential system compromise. The vulnerability was identified by the OpenSSF Package Analysis project, which flagged versions 1.0.2 and 1.0.6 as malicious. The risk is particularly high for applications that rely on this package for critical functionalities, as attackers could exploit this vulnerability to gain control over affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall transparent-example-request99If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can replace 'transparent-example-request99' with a different, trusted HTTP request library. For example, you can use 'axios' or 'node-fetch' as alternatives. To install 'axios', run: 'npm install axios'.
Conclusion
The 'transparent-example-request99' package has been flagged as malicious due to its harmful behavior, which can lead to serious security risks. Users are advised to uninstall the package and consider alternative libraries for making HTTP requests. Utilizing tools like Vulert can help in proactively monitoring for vulnerabilities in your applications.
See every vulnerability recorded for transparent-example-request99 →
FAQ
The package communicates with domains linked to malicious activities and executes commands that can compromise system security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
It is recommended to uninstall the package immediately and replace it with a trusted alternative like 'axios' or 'node-fetch'.
Currently, there are no patched versions available for 'transparent-example-request99'. All identified versions are considered malicious.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities, ensuring your application remains secure.
