Malicious Code Detected in bnrn-cli-snapshot Package
Summary
MAL-2025-15912: Malicious code in bnrn-cli-snapshot (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bnrn-cli-snapshot package is a tool designed for command-line interface operations within the Node.js ecosystem. It allows developers to streamline their workflows and automate tasks. However, this package has been found to contain malicious code, posing a significant risk to users who rely on it for their development processes.
Vulnerability Detail
The vulnerability in the bnrn-cli-snapshot package originates from the inclusion of malicious code that can compromise the security of systems using this package. The malicious code could potentially lead to unauthorized access, data breaches, or other harmful actions. Users of this package are at risk of having their systems manipulated or their data exposed due to this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bnrn-cli-snapshotIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should refrain from using the bnrn-cli-snapshot package until a fixed version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The bnrn-cli-snapshot package has been identified as containing malicious code, which poses a serious risk to users. It is crucial to take immediate action by updating the package or finding alternatives to ensure the security of your systems.
See every vulnerability recorded for bnrn-cli-snapshot →
FAQ
bnrn-cli-snapshot is a command-line interface tool for Node.js that helps automate tasks and streamline workflows.
The specific nature of the malicious code has not been disclosed, but it poses risks such as unauthorized access and data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are using the bnrn-cli-snapshot package, immediately stop using it and update to a patched version once available.
Yes, consider using other command-line interface tools that do not have known vulnerabilities.
