Critical Malicious Code Vulnerability in url-encode-decode Package
Summary
MAL-2025-190940: Malicious code in url-encode-decode (npm). Affects url-encode-decode versions 1.0.1 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The url-encode-decode package is an npm library designed for encoding and decoding URLs. It is commonly used in web applications to ensure that URLs are properly formatted for transmission over the internet. However, this package has been found to contain malicious code that compromises the security of any system using it. The presence of such code can lead to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the url-encode-decode package. This code can fully compromise any computer that has the package installed or running, allowing an attacker to gain control over the system. The ramifications of this vulnerability are severe, as it can lead to the exposure of sensitive information, including secrets and keys stored on the affected machine. Users are advised to treat any system running this package as compromised and take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall url-encode-decodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. If your application relies on this package, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The url-encode-decode package has been identified as containing malicious code that poses a significant security risk. Users are strongly advised to remove this package from their systems and take necessary precautions to secure their sensitive information. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for url-encode-decode →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failing to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential loss of sensitive information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
Yes, consider using other URL encoding and decoding libraries that do not have known vulnerabilities.
