Critical Malicious Code Vulnerability in acronis-platform-configs Package
Summary
MAL-2025-6272: Malicious code in acronis-platform-configs (npm). Affects acronis-platform-configs versions >= 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acronis-platform-configs package is an npm library designed to facilitate configuration management for Acronis platforms. It provides essential functionalities for developers working with Acronis services, enabling seamless integration and configuration. However, this package has been identified to communicate with a domain associated with malicious activities, raising significant security concerns.
Vulnerability Detail
The vulnerability stems from the package's communication with a domain linked to malicious activities. This could potentially lead to unauthorized data access, data breaches, or the execution of harmful code within applications utilizing this package. The issue was introduced in version 99.0.0, and it is crucial for users to be aware of the risks associated with using this package in their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall acronis-platform-configsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the acronis-platform-configs package from your project until a secure version is released. You can do this by executing: npm uninstall acronis-platform-configs.
Conclusion
The acronis-platform-configs package has a critical vulnerability that allows communication with a malicious domain. Users are advised to update or remove the package to protect their applications from potential threats. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of vulnerabilities.
See every vulnerability recorded for acronis-platform-configs →
FAQ
The acronis-platform-configs package is an npm library used for managing configurations in Acronis platforms.
The vulnerability involves the package communicating with a domain associated with malicious activities, posing security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider removing the package as a temporary measure to mitigate risks.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file, ensuring your application remains secure.
