Malicious Code Detected in azure-documentdb-node Package - Version 9.9.9
Summary
MAL-2025-6865: Malicious code in azure-documentdb-node (npm). Affects azure-documentdb-node versions 9.9.2 – 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The azure-documentdb-node package is a Node.js client library designed for interacting with Azure DocumentDB (now known as Azure Cosmos DB). It enables developers to perform CRUD operations on documents stored in Azure's NoSQL database. However, certain versions of this package have been identified as malicious, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the malicious version 9.9.9 of the azure-documentdb-node package. This version has been flagged for communicating with domains associated with malicious activities and executing commands that are harmful to the system. The implications of this vulnerability include unauthorized data access, potential data loss, and compromise of the application's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall azure-documentdb-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not possible, consider removing the package from your project or replacing it with an alternative library that provides similar functionality without the associated risks.
Conclusion
The azure-documentdb-node package has been identified as containing malicious code in specific versions. It is crucial for developers to update to a safe version to protect their applications from potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for azure-documentdb-node →
FAQ
Versions 9.9.9 and 9.9.2 of the azure-documentdb-node package have been identified as malicious.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can help identify if your application is affected by this vulnerability.
Using the malicious version can lead to unauthorized access to sensitive data, execution of harmful commands, and overall compromise of your application's security.
Yes, Vulert offers a playground where you can check if your application is affected by vulnerabilities without needing to sign up. Visit Vulert Scanner to use this feature.
If you cannot update the package right away, consider removing it from your project or using an alternative library to mitigate the risk.
