Malicious Code Detected in askama Package - Security Alert
Summary
MAL-2025-6276: Malicious code in askama (npm). Affects askama versions >= 0.12.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The askama package is a templating engine for Rust, designed to facilitate the creation of HTML templates. It is widely used in web development for its efficiency and ease of integration. However, recent findings have revealed that certain versions of this package communicate with a domain linked to malicious activities, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the askama package arises from its communication with a domain associated with malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the affected applications. The issue was introduced in version 0.12.1, and it is crucial for developers to be aware of the implications of using this compromised version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall askamaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the affected version of the askama package by downgrading to a previous stable version that does not exhibit this malicious behavior. Use the command: npm install askama@<previous_version>, replacing <previous_version> with a version number prior to 0.12.1.
Conclusion
The discovery of malicious code in the askama package highlights the importance of maintaining up-to-date dependencies in software development. Developers should take immediate action to update or downgrade the package to mitigate potential security risks.
See every vulnerability recorded for askama →
FAQ
Askama is a templating engine for Rust that allows developers to create HTML templates easily and efficiently.
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise application security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Consider downgrading to a previous stable version of the askama package until you can apply the necessary updates.
The vulnerability was identified by Amazon Inspector, a security service that helps identify vulnerabilities in applications.
