Malicious Code Detected in avalon-util-cli: A Critical Security Alert
Summary
MAL-2025-15191: Malicious code in avalon-util-cli (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'avalon-util-cli' is a command-line interface tool designed for various utility functions within the Avalon framework. It is widely used in npm ecosystems for its ease of integration and functionality. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the 'avalon-util-cli' package. This code can potentially compromise user data, lead to unauthorized access, and disrupt application functionality. The issue was introduced in version 0 and affects all subsequent versions, making it imperative for users to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall avalon-util-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the 'avalon-util-cli' package until a secure version is released. Alternatively, consider using other CLI tools that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the 'avalon-util-cli' package highlights the importance of maintaining vigilance in software dependencies. Users are urged to update their packages promptly and consider using tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for avalon-util-cli →
FAQ
The malicious code can compromise user data and lead to unauthorized access, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Users should check the package repository for any patched versions and update accordingly.
Consider using alternative CLI tools or refrain from using 'avalon-util-cli' until a secure version is released.
The vulnerability was identified by Amazon Inspector, a security tool that helps in identifying vulnerabilities in software packages.
