Malicious Code Vulnerability in workvivo-chatbot Package
Summary
MAL-2025-192887: Malicious code in workvivo-chatbot (npm). Affects workvivo-chatbot versions 0.0.1 – 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The workvivo-chatbot package is an npm library designed to facilitate chatbot functionalities within the Workvivo platform. It allows developers to integrate conversational interfaces that enhance user engagement. However, this package has been identified with a serious vulnerability that exposes users to potential malicious code execution.
Vulnerability Detail
The vulnerability in the workvivo-chatbot package stems from the inclusion of malicious code that can compromise the security of applications utilizing this library. This issue was reported by ReversingLabs and affects versions 0.0.1 and 1.0.0. The malicious code can lead to unauthorized access, data breaches, and other security risks, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall workvivo-chatbotIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions (0.0.1 and 1.0.0) of the workvivo-chatbot package until a secure version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The workvivo-chatbot package has a critical vulnerability due to malicious code that can compromise application security. Users are urged to update to a patched version or seek alternatives until a fix is available. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for workvivo-chatbot →
FAQ
The workvivo-chatbot package is an npm library that enables developers to integrate chatbot functionalities into the Workvivo platform.
Versions 0.0.1 and 1.0.0 of the workvivo-chatbot package are affected by the malicious code vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, refrain from using the affected versions and consider alternative packages until a secure version is available.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
