Critical Malicious Code Vulnerability in vjri Package
Summary
MAL-2026-122: Malicious code in vjri (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vjri package is a JavaScript library available through npm, designed for specific functionalities within Node.js applications. It is commonly used for various tasks, but its recent exposure to malicious code has raised significant security concerns. Users of this package should be aware of its potential risks, especially in environments where sensitive data is handled.
Vulnerability Detail
This vulnerability stems from the presence of embedded malicious code within the vjri package. Identified as GHSA-8c45-7hqf-gqqq, it poses a severe threat to any computer that has the package installed. The malicious code can lead to full compromise of the system, allowing unauthorized access to secrets and keys stored on the affected machine. The implications of this vulnerability are dire, as it may result in data breaches and loss of control over sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vjriIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that all secrets and keys stored on the compromised computer are rotated immediately from a different, secure machine. This step is essential to mitigate the risk of unauthorized access.
Conclusion
The vjri package has been identified as containing malicious code, leading to severe security risks for users. Immediate action is required to remove the package and secure any sensitive data. Users are encouraged to stay vigilant and utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for vjri →
FAQ
The vjri package is a JavaScript library used in Node.js applications for various functionalities, but it has recently been compromised with malicious code.
If you have the vjri package installed, your system may be compromised. It is recommended to remove the package and rotate any sensitive information.
Immediately rotate all secrets and keys from a different, secure machine to prevent unauthorized access.
Currently, there is no patch available. The best course of action is to remove the package entirely.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. Check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
