Malicious Code Detected in autozvit Package - Security Alert
Summary
MAL-2025-15125: Malicious code in autozvit (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The autozvit package is an npm library designed for specific functionalities within JavaScript applications. It is utilized by developers for various tasks, but its recent discovery of malicious code poses a significant threat to users. The package's functionality may be compromised, leading to potential security breaches and data integrity issues.
Vulnerability Detail
The vulnerability in the autozvit package stems from the inclusion of malicious code that can execute harmful actions on the user's system. This code can lead to unauthorized access, data theft, or other malicious activities. The issue was identified in version 0 and has been classified as a serious security risk, necessitating immediate attention from users and developers alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall autozvitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the autozvit package from their project until a secure version is available. This can be accomplished by executing: 'npm uninstall autozvit'.
Conclusion
The discovery of malicious code in the autozvit package poses a serious threat to users. It is crucial to update the package to the latest version or remove it from your project until a secure version is available. Stay informed about vulnerabilities using tools like Vulert.
See every vulnerability recorded for autozvit →
FAQ
The autozvit package is an npm library used in JavaScript applications for various functionalities.
The malicious code can execute harmful actions, potentially leading to unauthorized access and data theft.
You can use Vulert to monitor and alert for vulnerabilities in your application. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, you can uninstall the autozvit package until a secure version is released.
Detailed information can be found on the GitHub page of the malicious package: https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/autozvit/MAL-2025-15125.json.
