Malicious Code Detected in @zalastax/nolb-graph2 Package
Summary
MAL-2025-11738: Malicious code in @zalastax/nolb-graph2 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @zalastax/nolb-graph2 package is a Node.js library designed for graph-related functionalities, allowing developers to create and manipulate graphs easily. However, it has been identified to contain malicious code, posing significant risks to applications that utilize it. This vulnerability can compromise the integrity and security of the software relying on this package.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the @zalastax/nolb-graph2 package. This code can lead to unauthorized access, data breaches, or other harmful actions within the application. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @zalastax/nolb-graph2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative packages that provide similar graph functionalities without the associated risks. Always ensure to review the package's security history before integrating it into your project.
Conclusion
The discovery of malicious code in the @zalastax/nolb-graph2 package poses a serious threat to applications using it. Immediate action is required to mitigate risks by uninstalling the package and exploring alternatives. Keeping your dependencies secure is crucial for maintaining the integrity of your software.
See every vulnerability recorded for @zalastax/nolb-graph2 →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data or execute harmful actions within the application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Immediately uninstall the package using npm uninstall @zalastax/nolb-graph2 and look for alternative packages or wait for a patched version.
Uninstalling the package should not cause data loss, but ensure you have backups of your project before making changes.
It is uncertain if a patch will be released. Monitor the package repository for any announcements regarding updates.
