Malicious Code Detected in uniswap-info Package - Version 99999.0.0
Summary
MAL-2026-2007: Malicious code in uniswap-info (npm). Affects uniswap-info versions 99999.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'uniswap-info' package is a Node.js library commonly used in decentralized finance (DeFi) applications to interact with the Uniswap protocol. It provides functionalities for fetching information about liquidity pools, token swaps, and other relevant data. However, the package version 99999.0.0 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the 'uniswap-info' package arises from its communication with a domain linked to malicious activities. This behavior indicates that the package may execute harmful commands, potentially compromising user data and system security. The OpenSSF Package Analysis project identified this issue, categorizing the package as malicious due to its actions that align with known malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uniswap-infoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'uniswap-info' package altogether until a secure version is released. If you need to continue using it, consider isolating its usage in a controlled environment to minimize risk.
Conclusion
The 'uniswap-info' package version 99999.0.0 has been identified as malicious, posing significant risks to users and applications. It is essential to take immediate action to mitigate these risks by updating or removing the package. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure the security of your software.
See every vulnerability recorded for uniswap-info →
FAQ
The 'uniswap-info' package is a Node.js library designed to interact with the Uniswap protocol, providing essential data for decentralized finance applications.
A malicious package is one that contains harmful code or behavior, such as unauthorized data access, communication with malicious domains, or execution of harmful commands.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can provide real-time alerts. You can also check your application using the Vulert playground without any signup.
If immediate updates are not possible, consider isolating the use of the package and monitoring your application for any unusual behavior. Implementing additional security measures may also help mitigate risks.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis project documentation, which provides insights into the malicious behavior of the 'uniswap-info' package.
