Malicious Code Detected in @zalastax/nolb-nodebm Package
Summary
MAL-2025-12764: Malicious code in @zalastax/nolb-nodebm (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @zalastax/nolb-nodebm package is an npm library designed for Node.js applications, providing functionalities that enhance database management. However, it has been identified to contain malicious code, posing significant security risks to applications that utilize it. This vulnerability can lead to unauthorized access, data breaches, or other malicious activities.
Vulnerability Detail
The vulnerability in the @zalastax/nolb-nodebm package stems from the inclusion of malicious code that was intentionally introduced. This code can compromise the security of applications using the package, potentially allowing attackers to execute harmful actions or gain unauthorized access to sensitive data. The issue was first detected in version 0 and affects all subsequent versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @zalastax/nolb-nodebmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks posed by this vulnerability other than removing the package entirely from your project.
Conclusion
The @zalastax/nolb-nodebm package has been found to contain malicious code, posing significant risks to applications that utilize it. It is crucial to uninstall the package immediately and monitor for any updates or patches. Utilizing tools like Vulert can help in identifying and managing vulnerabilities effectively.
See every vulnerability recorded for @zalastax/nolb-nodebm →
FAQ
The malicious code is designed to exploit vulnerabilities in applications, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should immediately uninstall the @zalastax/nolb-nodebm package from your project to prevent any potential security risks.
As of now, there is no safe version available. It is recommended to remove the package until a secure version is released.
Vulert uses your package-lock.json file to monitor and alert in real-time for open-source vulnerabilities, ensuring your application remains secure.
