Critical Malicious Code Vulnerability in atmpaxos Package
Summary
MAL-2025-15020: Malicious code in atmpaxos (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The atmpaxos package is an npm library designed for implementing the Paxos consensus algorithm, which is widely used in distributed systems to achieve agreement among multiple nodes. It is known for its reliability and efficiency in managing state across distributed applications. However, this package has recently been identified to contain malicious code, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability in the atmpaxos package stems from the inclusion of malicious code that can compromise the security of applications utilizing this library. This malicious code may allow unauthorized access to sensitive data, execute arbitrary commands, or disrupt the normal functioning of the application. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall atmpaxosIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the atmpaxos package from their project until a secure version is released. This can be done using the command: npm uninstall atmpaxos. Alternatively, consider using a different library that provides similar functionality without the associated risks.
Conclusion
The atmpaxos package has been identified to contain malicious code, posing serious security risks to applications that utilize it. Users are advised to update or remove the package until a secure version is released. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for atmpaxos →
FAQ
The atmpaxos package is used for implementing the Paxos consensus algorithm in distributed systems, ensuring reliable state management across nodes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json file without any signup.
Using the compromised atmpaxos package can lead to unauthorized access to sensitive data, execution of arbitrary commands, and potential disruption of application functionality.
As of now, a patch has not been released. Users should monitor the package repository for updates and apply them as soon as they are available.
If immediate removal is not possible, consider isolating the affected components and implementing strict access controls to mitigate potential risks until a secure version is available.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
