Critical Malicious Code Vulnerability in typescript-rtk-query Package
Summary
MAL-2026-1537: Malicious code in typescript-rtk-query (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The typescript-rtk-query package is a library designed for efficient data fetching and state management in TypeScript applications. It provides developers with tools to streamline API interactions and manage server state effectively. However, recent findings have revealed that this package contains malicious code, posing significant security risks to any application that utilizes it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the typescript-rtk-query package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code means that simply removing the package may not eliminate all traces of the compromise, as full control of the affected system may have been granted to an external entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall typescript-rtk-queryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if you need similar functionality, consider using alternative packages that provide data fetching and state management capabilities without the associated risks. Always ensure to review the security status of any package before installation.
Conclusion
The discovery of malicious code within the typescript-rtk-query package highlights the importance of vigilance in managing open-source dependencies. Immediate action is required to mitigate risks associated with this vulnerability, including the removal of the package and the rotation of any compromised secrets.
See every vulnerability recorded for typescript-rtk-query →
FAQ
Immediately uninstall the package using 'npm uninstall typescript-rtk-query' and rotate any exposed secrets or keys.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Leaving the package installed can lead to unauthorized access to sensitive information and potential full control of your system by malicious actors.
Yes, consider using other well-reviewed packages for data fetching and state management that do not have known vulnerabilities.
Regularly monitor your dependencies using tools like Vulert, and always check for vulnerabilities before installing new packages.
