Malicious Code Detected in adform-data-generator: Security Alert
Summary
MAL-2025-14089: Malicious code in adform-data-generator (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The adform-data-generator package is an npm library designed for generating data for Adform-related applications. It is commonly used by developers to simulate data for testing and development purposes. However, this package has been found to contain malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability in the adform-data-generator package originates from the inclusion of malicious code that can compromise the security of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. Users of this package are at risk of exploitation, which can have severe consequences for data integrity and application performance.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall adform-data-generatorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using an alternative package that provides similar functionality without the associated risks. Additionally, you can monitor your application for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file to detect potential threats.
Conclusion
The discovery of malicious code in the adform-data-generator package highlights the importance of vigilance in software development. Users must take immediate action to remove the affected package and consider alternatives to safeguard their applications. Utilizing tools like Vulert can enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for adform-data-generator →
FAQ
The adform-data-generator package is an npm library used for generating test data for Adform applications, aiding developers in simulating various scenarios.
The malicious code found in the adform-data-generator package can potentially lead to unauthorized access and data breaches, compromising the security of applications.
You can check if your application is affected by using Vulert, which allows you to analyze your package-lock.json file for vulnerabilities without requiring any installation.
If you are using the adform-data-generator package, it is recommended to remove it immediately and look for alternative packages that do not pose security risks.
Vulert monitors and alerts users in real-time for open-source vulnerabilities by analyzing the package-lock.json file, providing insights into potential threats without needing access to the code.
