Malicious Code Detected in binance-dev Package - Security Alert
Summary
MAL-2025-6277: Malicious code in binance-dev (npm). Affects binance-dev versions >= 10.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The binance-dev package is an npm library designed to facilitate interactions with the Binance cryptocurrency exchange. It provides developers with tools to access various functionalities of the Binance API, enabling them to build applications that can trade, retrieve market data, and manage user accounts. However, this package has been identified as having a vulnerability that allows it to communicate with a domain linked to malicious activities, posing a risk to users and their applications.
Vulnerability Detail
The vulnerability in the binance-dev package arises from its ability to connect to a domain associated with malicious activities. This can lead to unauthorized data access, potential data breaches, and exploitation of user credentials. The issue was introduced in version 10.0.1, and it is crucial for users to be aware of the risks involved in using this package without addressing the vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall binance-devIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the binance-dev package until a secure version is released. Alternatively, consider using other libraries that provide similar functionality without the associated risks.
Conclusion
The binance-dev package has been identified as having a serious vulnerability that allows it to connect to a malicious domain. Users are strongly encouraged to update the package as soon as a patched version is available or to seek alternative solutions to mitigate potential risks. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in your applications.
See every vulnerability recorded for binance-dev →
FAQ
The binance-dev package is an npm library that allows developers to interact with the Binance cryptocurrency exchange API.
The package communicates with a domain linked to malicious activities, which could lead to unauthorized access to sensitive data.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it provides real-time alerts for vulnerabilities. You can check your application using the Vulert playground at Vulert Scanner.
As of now, there is no patched version available. Users are advised to monitor updates and apply them as soon as they are released.
If you cannot update the package, consider using alternative libraries that offer similar functionality without the security risks associated with binance-dev.
