Malicious Code Detected in volume-viz Package - Version 5.5.5
Summary
MAL-2025-192372: Malicious code in volume-viz (npm). Affects volume-viz versions 5.5.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The volume-viz package is an npm library designed for visualizing data volumes in various applications. It provides functionalities to create visual representations of data, making it easier for developers to analyze and present information. However, version 5.5.5 has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the volume-viz package arises from its communication with a domain associated with malicious activities. This behavior poses significant risks, including data breaches, unauthorized access, and potential exploitation of systems using this package. The identification of this malicious code was made by the OpenSSF Package Analysis project, which monitors and evaluates the safety of open-source packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall volume-vizIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the volume-viz package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall volume-viz.
Conclusion
The volume-viz package version 5.5.5 has been identified as malicious due to its communication with a harmful domain. Users are advised to update or remove the package to mitigate potential risks. Regular monitoring of open-source dependencies is crucial for maintaining application security.
See every vulnerability recorded for volume-viz →
FAQ
The volume-viz package is used for visualizing data volumes in applications, helping developers create visual representations of data.
The malicious behavior was identified by the OpenSSF Package Analysis project, which monitors open-source packages for security issues.
Using the compromised version can lead to data breaches, unauthorized access, and exploitation of your application.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If you cannot update the package immediately, consider removing it from your project as a temporary measure until a secure version is available.
