Malicious Code Detected in wartsila-application-json Package - Critical Vulnerability
Summary
MAL-2025-191482: Malicious code in wartsila-application-json (npm). Affects wartsila-application-json versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wartsila-application-json package, available on npm, is designed to facilitate the handling of JSON data within applications. It is typically used for parsing and generating JSON objects, making it a common choice for developers working with JavaScript. However, the package version 1.0.0 has been flagged for malicious behavior, raising significant security concerns for users relying on it.
Vulnerability Detail
The vulnerability in the wartsila-application-json package arises from its execution of commands associated with malicious behavior. This can potentially lead to unauthorized access, data breaches, or system compromise. The OpenSSF Package Analysis project identified this issue, emphasizing the need for immediate action to mitigate risks associated with using this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wartsila-application-jsonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the wartsila-application-json package altogether and look for alternative libraries that provide similar functionality without the associated risks. Additionally, you can monitor your project using tools like Vulert, which can alert you to vulnerabilities in your dependencies.
Conclusion
The wartsila-application-json package version 1.0.0 has been identified as malicious, necessitating immediate action from users to mitigate potential security risks. By uninstalling the affected package and monitoring for vulnerabilities using tools like Vulert, developers can enhance the security of their applications.
See every vulnerability recorded for wartsila-application-json →
FAQ
It is an npm package used for handling JSON data in JavaScript applications.
Version 1.0.0 executes commands that are considered malicious, posing security risks.
You can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
You should uninstall the wartsila-application-json package and look for a secure alternative or updated version.
Vulert monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities in your software.
