Malicious Code Detected in activerecord-firewall Package
Summary
MAL-2025-14051: Malicious code in activerecord-firewall (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The activerecord-firewall package is an npm library designed to enhance security for applications using ActiveRecord by providing a firewall mechanism. It aims to protect against unauthorized database access and potential SQL injection attacks. However, a recent discovery has revealed that this package contains malicious code, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability in the activerecord-firewall package stems from the inclusion of malicious code that can compromise the integrity and security of applications utilizing this library. This code may allow unauthorized access to sensitive data, lead to data breaches, or enable attackers to execute arbitrary commands within the application environment. The malicious code was introduced in version 0 and affects all subsequent versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall activerecord-firewallIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar functionality without the associated risks. Always ensure to review the package's security history and community feedback before integrating it into your project.
Conclusion
The discovery of malicious code in the activerecord-firewall package highlights the importance of vigilance when using open-source libraries. Users are advised to remove the affected package and monitor their applications for any unusual activity. Utilizing tools like Vulert can help in identifying vulnerabilities in real-time.
See every vulnerability recorded for activerecord-firewall →
FAQ
The activerecord-firewall package is an npm library that enhances security for applications using ActiveRecord by providing a firewall mechanism.
The malicious code was identified by security researchers from Amazon Inspector, who reported it as part of their ongoing efforts to monitor and secure open-source packages.
The risks include unauthorized access to sensitive data, potential data breaches, and the ability for attackers to execute arbitrary commands within the application.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. By utilizing the Vulert playground, you can check if your application is affected without requiring access to the code or installation.
If you have used the activerecord-firewall package, it is recommended to uninstall it immediately and consider using alternative packages that provide similar functionality.
