Malicious Code Detected in async-promise-testing Package
Summary
MAL-2025-14991: Malicious code in async-promise-testing (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The async-promise-testing package is an npm library designed to facilitate testing of asynchronous code in JavaScript applications. It provides utilities that help developers write tests for promises and async functions efficiently. However, this package has been found to contain malicious code, which poses a significant risk to applications that depend on it.
Vulnerability Detail
The vulnerability in the async-promise-testing package stems from the inclusion of malicious code that can compromise the integrity of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected software. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall async-promise-testingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the async-promise-testing package from your project until a secure version is released. You can do this by running the command: 'npm uninstall async-promise-testing'. Alternatively, you may explore other testing libraries that do not have known vulnerabilities.
Conclusion
The async-promise-testing package has been identified as containing malicious code, posing a serious risk to applications that rely on it. Users must take immediate action to update or remove the package to safeguard their software. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for async-promise-testing →
FAQ
async-promise-testing is an npm library used for testing asynchronous JavaScript code, particularly promises and async functions.
The malicious code can potentially lead to unauthorized access and data breaches in applications that utilize the async-promise-testing package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Users are advised to check the package repository for any patched versions of async-promise-testing and update accordingly.
If an immediate update is not possible, consider uninstalling the package or using alternative libraries until a secure version is available.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
