Malicious Code Detected in aviation-scrapper Package
Summary
MAL-2025-15200: Malicious code in aviation-scrapper (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aviation-scrapper package is an npm library designed for scraping aviation-related data. It is utilized by developers to gather information about flights, airports, and other aviation metrics. However, this package has been identified to contain malicious code, posing significant risks to applications that depend on it.
Vulnerability Detail
The vulnerability in the aviation-scrapper package stems from the inclusion of malicious code that can compromise the security of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other malicious activities. The issue was introduced in version 0 of the package and affects all subsequent versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall aviation-scrapperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the aviation-scrapper package and look for alternative libraries that provide similar functionality without the associated risks.
Conclusion
The aviation-scrapper package has been found to contain malicious code, posing a significant threat to applications that utilize it. It is crucial to remove this package and consider alternatives to ensure the security of your application.
See every vulnerability recorded for aviation-scrapper →
FAQ
The aviation-scrapper package is an npm library used for scraping data related to aviation, such as flight information and airport details.
The malicious code can potentially lead to unauthorized access and data breaches, compromising the security of applications that use this package.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, it can identify if your application is affected.
The best mitigation strategy is to remove the aviation-scrapper package from your project and consider using alternative libraries.
You can find detailed information about the vulnerability on the GitHub repository of the malicious packages project or by visiting Vulert's website.
