Malicious Code Detected in additem Package - Security Alert
Summary
MAL-2025-14072: Malicious code in additem (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The additem package is an npm module designed for adding items to collections in JavaScript applications. It is commonly used for managing lists and inventories in various web applications. However, this package has been identified to contain malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the additem package stems from the inclusion of malicious code that can compromise the security of applications utilizing this package. This code may allow unauthorized access to sensitive data, execute arbitrary commands, or lead to further exploitation of the system. The malicious code was introduced in version 0 and affects all subsequent versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall additemIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that offer similar functionalities without the associated risks. Always review the package's security history before integrating it into your project.
Conclusion
The discovery of malicious code in the additem package highlights the importance of regularly monitoring and auditing third-party packages used in your applications. By taking prompt action to remove the affected package and exploring alternatives, you can safeguard your applications against potential security threats.
See every vulnerability recorded for additem →
FAQ
The additem package is an npm module used for managing collections and lists in JavaScript applications.
The malicious code was introduced in version 0 of the additem package and affects all subsequent versions.
Using the compromised additem package can lead to unauthorized access to sensitive data, execution of arbitrary commands, and further exploitation of your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have already used the additem package, uninstall it immediately and consider using alternative packages that do not pose security risks.
