Malicious Code Detected in @toptal/davinci-graphql-codegen-extensions: Security Alert
Summary
MAL-2025-6036: Malicious code in @toptal/davinci-graphql-codegen-extensions (npm). Affects @toptal/davinci-graphql-codegen-extensions versions 1.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @toptal/davinci-graphql-codegen-extensions package is a tool designed for generating GraphQL code, enhancing developer productivity by automating repetitive tasks. However, it has been identified to communicate with a domain linked to malicious activities, raising serious security concerns for users relying on this package.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain associated with malicious activity. This could lead to unauthorized data access, potential data breaches, or the execution of harmful code within applications utilizing this package. Users of the package are at risk of compromising their systems and data integrity due to this malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @toptal/davinci-graphql-codegen-extensionsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the package from your project until a secure version is released. You can do this by executing: npm uninstall @toptal/davinci-graphql-codegen-extensions.
Conclusion
The @toptal/davinci-graphql-codegen-extensions package has been flagged for malicious activity, necessitating immediate attention from users. Updating or removing the package is essential to safeguard your applications from potential threats. Stay vigilant and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for @toptal/davinci-graphql-codegen-extensions →
FAQ
The package has been found to communicate with a domain that is known for malicious activities, which poses a risk to users' systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not feasible, consider removing the package from your project as a temporary measure to mitigate risks.
While specific exploits have not been detailed, the potential for unauthorized access and data breaches exists due to the package's behavior.
Regularly check the package's repository and utilize tools like Vulert to receive alerts on any new vulnerabilities affecting your dependencies.
