Malicious Code Vulnerability in wpt-client Package
Summary
MAL-2026-1878: Malicious code in wpt-client (npm). Affects wpt-client versions 100.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wpt-client package is a tool designed for interacting with WebPageTest, a service that allows users to run performance tests on their web applications. This package facilitates the automation of testing processes, providing developers with insights into their application's performance metrics. However, it has been found to contain malicious code, posing a significant risk to users who rely on it for performance testing.
Vulnerability Detail
The vulnerability identified in the wpt-client package is characterized by the presence of malicious code that can compromise the security of applications utilizing this package. This issue originated from a malicious actor who injected harmful code into the package, which can lead to unauthorized access, data breaches, or other security incidents. The specific version affected is 100.0.0, and users are strongly advised to take immediate action to mitigate the risks associated with this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wpt-clientIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the wpt-client package until the vulnerability is resolved. Additionally, consider using alternative packages for performance testing that do not have known vulnerabilities.
Conclusion
The wpt-client package has been found to contain malicious code, posing a serious security risk to users. It is crucial to update to the latest version of the package to mitigate this vulnerability. Users are also encouraged to explore alternative solutions and utilize tools like Vulert for ongoing monitoring of their applications.
See every vulnerability recorded for wpt-client →
FAQ
The wpt-client package is a tool for interacting with WebPageTest, allowing developers to automate performance testing of their web applications.
The malicious code can compromise the security of applications, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring installation.
As a temporary measure, avoid using the wpt-client package and consider using alternative performance testing tools until the vulnerability is addressed.
The vulnerability was reported by ReversingLabs, a security research organization specializing in identifying malicious packages.
