Malicious Activity Detected in @xene/core Package - Vulnerability MAL-2025-6069
Summary
MAL-2025-6069: Malicious code in @xene/core (npm). Affects @xene/core versions 0.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @xene/core package is a component of the npm ecosystem, designed to facilitate various functionalities in JavaScript applications. It is widely used for its performance and ease of integration. However, this package has been identified to communicate with a domain associated with malicious activities, raising significant security concerns for users and developers relying on it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6069 stems from the @xene/core package's communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications utilizing this package. The risk is particularly pronounced for applications that handle sensitive data or are deployed in production environments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @xene/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, consider removing the @xene/core package from your project until a secure version is confirmed. You can do this by executing the command: 'npm uninstall @xene/core'. Additionally, monitor your application for any unusual behavior that may indicate exploitation of this vulnerability.
Conclusion
The @xene/core package has been flagged for a serious vulnerability due to its communication with a malicious domain. It is crucial for developers and users to take immediate action by updating or removing the package to safeguard their applications from potential threats.
See every vulnerability recorded for @xene/core →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, posing risks to application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not feasible, consider removing the package and monitoring your application for any suspicious activities.
While specific exploits have not been detailed, the communication with a malicious domain indicates a high risk of potential exploitation.
Detailed information can be found in the vulnerability report at https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@xene/core/MAL-2025-6069.json.
