Malicious Code Detected in buffer-nodejs-fomalhaut-fetch Package
Summary
MAL-2025-16291: Malicious code in buffer-nodejs-fomalhaut-fetch (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-nodejs-fomalhaut-fetch package is an npm library designed for handling buffer operations in Node.js applications. It is commonly used for data manipulation and processing tasks. However, this package has been identified as containing malicious code, which poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability arises from the presence of malicious code within the buffer-nodejs-fomalhaut-fetch package. This code can lead to unauthorized access, data breaches, or other harmful actions within the application. The issue was introduced in version 0 and affects all subsequent versions. Users of this package should be aware of the potential ramifications, including compromised application integrity and data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall buffer-nodejs-fomalhaut-fetchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages that provide similar functionality without the associated risks. Review your application's dependencies and replace buffer-nodejs-fomalhaut-fetch with a secure alternative.
Conclusion
The buffer-nodejs-fomalhaut-fetch package has been identified as containing malicious code, posing significant security risks. Users are advised to remove the package and monitor for updates or patches. Utilizing tools like Vulert can help keep your application secure by providing real-time vulnerability alerts.
See every vulnerability recorded for buffer-nodejs-fomalhaut-fetch →
FAQ
It is an npm library used for buffer operations in Node.js applications.
The package contains code that can lead to unauthorized access and potential data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Remove the package from your project and consider using a secure alternative.
Currently, there is no patched version available. It is advisable to remove the package until a fix is released.
