Critical Malicious Code Vulnerability in unemail Package
Summary
MAL-2025-191440: Malicious code in unemail (npm). Affects unemail versions 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unemail package is an npm library designed for managing email functionalities within JavaScript applications. It is widely used due to its simplicity and effectiveness in handling email-related tasks. However, the package has been compromised, leading to significant security concerns that can affect any system utilizing it.
Vulnerability Detail
The vulnerability stems from a malicious payload embedded within the unemail package, which is part of the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from the user's environment and publish them to GitHub. It can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. Additionally, there is a risk that it may destroy the user's home directory, leading to severe data loss and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall unemailIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks posed by this vulnerability other than removing the package and securing your environment.
Conclusion
The unemail package has been compromised, posing significant risks to any system using it. Immediate action is required to remove the package and secure your environment. Regular monitoring and using tools like Vulert can help prevent future vulnerabilities.
See every vulnerability recorded for unemail →
FAQ
You should immediately remove the unemail package and rotate any secrets or keys stored on your system.
The malicious code can steal sensitive information, propagate to other packages, and potentially destroy your home directory.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Regularly monitor your dependencies and use tools like Vulert to stay informed about vulnerabilities in your packages.
The vulnerability originated from a malicious npm worm known as Sha1-Hulud: The Second Coming, which compromised the unemail package.
