Critical Malicious Code Vulnerability in bridge-emulator Package
Summary
MAL-2025-6701: Malicious code in bridge-emulator (npm). Affects bridge-emulator versions >= 16.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bridge-emulator package is an npm library designed to facilitate communication between various blockchain networks by emulating bridge functionalities. It provides developers with tools to create decentralized applications that can interact across different blockchain ecosystems. However, this package has been found to communicate with a domain associated with malicious activities, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability identified in the bridge-emulator package originates from its version 16.0.0 and later, where it has been reported to connect to a domain linked to malicious activities. This connection can lead to unauthorized data access, potential data breaches, and exploitation of the application using this package. The malicious code could compromise the integrity of the application and the security of its users, making it imperative to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bridge-emulatorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the bridge-emulator package from your project until a secure version is available. This can be done by executing: 'npm uninstall bridge-emulator'. Alternatively, consider using an alternative package that provides similar functionality without the associated risks.
Conclusion
The bridge-emulator package has a critical vulnerability that allows it to communicate with a malicious domain, posing significant risks to applications using it. It is crucial to update or remove the package to safeguard your application and its users. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for bridge-emulator →
FAQ
The bridge-emulator package is used to facilitate communication between different blockchain networks, allowing developers to create decentralized applications that can interact across various ecosystems.
This vulnerability can lead to unauthorized access to sensitive data and may compromise the security of your application and its users.
You should immediately update the package to a secure version or remove it from your project until a fix is available.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
You can find more details about this vulnerability in the Open Source Vulnerability database or by visiting the GitHub repository associated with the bridge-emulator package.
