Critical Security Breach in v-plausible: Malicious Code Injection Detected
Summary
MAL-2025-191445: Malicious code in v-plausible (npm). Affects v-plausible versions 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
v-plausible is an npm package designed for tracking and analyzing user interactions in web applications. It provides developers with insights into user behavior, enabling them to make informed decisions about their applications. However, the package has recently been compromised, exposing users to significant security risks.
Vulnerability Detail
The vulnerability stems from a malicious code injection introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal sensitive tokens and credentials from users and publish them to GitHub. Additionally, it can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. The malicious payload poses a risk of destroying the user's home directory, leading to potential data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall v-plausibleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the v-plausible package from their project until a secure version is confirmed. This can be done using the command: npm uninstall v-plausible. Additionally, review your GitHub actions and remove any unauthorized scripts or actions that may have been introduced by the worm.
Conclusion
The v-plausible package has been compromised by a malicious worm, posing serious security risks to users. Immediate action is required to update or remove the package to protect sensitive information and maintain the integrity of your applications. Utilize tools like Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for v-plausible →
FAQ
v-plausible is an npm package that helps developers track user interactions within web applications, providing valuable insights for improving user experience.
The vulnerability was introduced by a malicious npm worm that compromised the package, allowing it to steal sensitive information and propagate itself.
If you have installed v-plausible, you should immediately update to the latest patched version or uninstall the package to mitigate risks.
Yes, the worm can propagate to other npm packages owned by the user, making it crucial to address the vulnerability promptly.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json. You can also check your application for vulnerabilities using the Vulert playground without any signup.
