Malicious Code Detected in avgmaker Package - Security Alert
Summary
MAL-2025-15198: Malicious code in avgmaker (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The avgmaker package is an npm library designed for generating average values from a set of numbers. It is commonly used in various applications that require statistical calculations. However, this package has been identified to contain malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability in the avgmaker package stems from the inclusion of malicious code that can compromise the security of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall avgmakerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the avgmaker package from their project until a secure version is available. This can be done using the command: npm uninstall avgmaker. Alternatively, consider using a different library that provides similar functionality without the security risks.
Conclusion
The avgmaker package has been identified to contain malicious code, posing a serious security risk to users. It is crucial to take immediate action by uninstalling the package and monitoring for updates. Utilizing tools like Vulert can help ensure your application remains secure against such vulnerabilities.
See every vulnerability recorded for avgmaker →
FAQ
avgmaker is an npm package used for calculating average values from a set of numbers.
The avgmaker package contains malicious code that can compromise the security of applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should immediately uninstall the avgmaker package and monitor for updates or patches that address the vulnerability.
Yes, consider using other statistical libraries available on npm that do not have known vulnerabilities.
