Malicious Code Detected in astro-benchmark Package - Security Alert
Summary
MAL-2025-6696: Malicious code in astro-benchmark (npm). Affects astro-benchmark versions >= 1.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The astro-benchmark package is a tool designed for benchmarking and performance testing in JavaScript applications. It provides developers with the ability to measure and analyze the performance of their code. However, recent findings have revealed that this package has been compromised, allowing it to communicate with a domain linked to malicious activities, posing a significant risk to users and their applications.
Vulnerability Detail
The vulnerability in the astro-benchmark package arises from its ability to connect to a malicious domain, which can lead to unauthorized data access, potential data breaches, and exploitation of the user's environment. This issue was introduced in version 1.4.5, making it critical for users to be aware of the risks associated with using this version or any subsequent versions that have not been patched.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall astro-benchmarkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the astro-benchmark package until a secure version is released. Alternatively, consider using other benchmarking tools that do not have known vulnerabilities.
Conclusion
The astro-benchmark package has been found to contain malicious code that poses a security threat to users. It is crucial to update the package to a secure version as soon as possible and to monitor your applications for any vulnerabilities using tools like Vulert.
See every vulnerability recorded for astro-benchmark →
FAQ
Astro-benchmark is a JavaScript package used for performance benchmarking and testing in applications.
The vulnerability allows the package to communicate with a malicious domain, which can lead to security risks such as data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider using alternative benchmarking tools or refrain from using the astro-benchmark package until a fix is available.
The vulnerability was identified by Amazon Inspector, a security tool that helps in identifying vulnerabilities in software packages.
