Malicious Code Detected in actions-set-env-vars Package - Security Alert
Summary
MAL-2025-6691: Malicious code in actions-set-env-vars (npm). Affects actions-set-env-vars versions >= 2.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The actions-set-env-vars package is an npm library designed to facilitate the setting of environment variables in GitHub Actions workflows. It is widely used for automating tasks in CI/CD pipelines. However, this package has been identified as having a vulnerability that allows it to communicate with a domain associated with malicious activities, potentially compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability in the actions-set-env-vars package originates from version 2.4.5, where the package was found to communicate with a domain linked to malicious activities. This could lead to unauthorized data access, exposure of sensitive information, or even remote code execution, depending on how the package is integrated into applications. The malicious behavior poses significant risks to developers and organizations relying on this package for their CI/CD processes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall actions-set-env-varsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider temporarily removing the actions-set-env-vars package from your project until a secure version is available. You can do this by executing the following command: npm uninstall actions-set-env-vars. Additionally, review your workflows to ensure that no critical tasks rely on this package.
Conclusion
The actions-set-env-vars package has been identified with a serious vulnerability that allows communication with a malicious domain. It is crucial for developers to update to a patched version or consider workarounds to mitigate risks. Utilizing tools like Vulert can enhance your security posture by providing real-time alerts on vulnerabilities.
See every vulnerability recorded for actions-set-env-vars →
FAQ
The actions-set-env-vars package is an npm library used in GitHub Actions to set environment variables for workflows.
The vulnerability allows the package to communicate with a malicious domain, posing risks such as unauthorized data access and potential remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, you can uninstall the actions-set-env-vars package until a secure version is released.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file, ensuring you stay informed about potential risks.
