Malicious Code Detected in @zalastax/nolb-nodebb-plugin-i: A Critical Security Alert
Summary
MAL-2025-12734: Malicious code in @zalastax/nolb-nodebb-plugin-i (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @zalastax/nolb-nodebb-plugin-i is an npm plugin designed for integration with NodeBB, a popular forum software. This plugin aims to enhance the functionality of NodeBB by providing additional features. However, it has been identified to contain malicious code, posing significant risks to users who have integrated it into their applications.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the @zalastax/nolb-nodebb-plugin-i package. This code can potentially compromise the security of applications using the plugin, leading to unauthorized access, data breaches, or other malicious activities. The issue is particularly concerning as it affects all versions starting from the initial release, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @zalastax/nolb-nodebb-plugin-iIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the plugin in their NodeBB configuration until a secure version is released. This can be done by commenting out or removing the plugin from the NodeBB plugin list in the configuration file.
Conclusion
The discovery of malicious code in the @zalastax/nolb-nodebb-plugin-i package poses a serious threat to users of NodeBB. It is crucial for developers to take immediate action by removing the plugin and monitoring for updates. Utilizing tools like Vulert can aid in maintaining the security of applications against such vulnerabilities.
See every vulnerability recorded for @zalastax/nolb-nodebb-plugin-i →
FAQ
The malicious code is designed to exploit vulnerabilities in applications using the plugin, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Immediately remove the plugin from your project and monitor for any updates or patches that may be released.
As of now, there is no patched version available. Users are advised to remove the plugin until further notice.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities, ensuring your application remains secure.
