Malicious Code Detected in 6sdgsd6s-control Package - MAL-2025-6898
Summary
MAL-2025-6898: Malicious code in 6sdgsd6s-control (npm). Affects 6sdgsd6s-control versions >= 9999.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 6sdgsd6s-control package is an npm library designed for various functionalities within JavaScript applications. However, it has been identified as a malicious package that communicates with a domain linked to harmful activities, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain associated with malicious activities. This can lead to data breaches, unauthorized access, and potential exploitation of the systems using this package. The issue was introduced in version 9999.0.0, making it critical for users to be aware of the risks involved with this specific version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall 6sdgsd6s-controlIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 6sdgsd6s-control package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall 6sdgsd6s-control.
Conclusion
The 6sdgsd6s-control package has been identified as malicious, and it is crucial for users to take immediate action to protect their applications. By updating or uninstalling the package, you can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for 6sdgsd6s-control →
FAQ
It is an npm package used in JavaScript applications, but it has been flagged for malicious behavior.
The vulnerability can lead to unauthorized access and data breaches, compromising the security of your application.
You should immediately update or uninstall the package to mitigate any risks associated with its use.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
