Malicious Code Detected in bug-bounty-hunter: A Critical Vulnerability
Summary
MAL-2025-6915: Malicious code in bug-bounty-hunter (npm). Affects bug-bounty-hunter versions >= 1337.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'bug-bounty-hunter' package is an npm library designed to assist developers in managing and participating in bug bounty programs. It provides tools for tracking vulnerabilities and rewards, making it a valuable asset for security researchers and developers. However, this package has been identified as having a serious vulnerability that connects it to a domain associated with malicious activities, potentially compromising user data and system integrity.
Vulnerability Detail
The vulnerability in the 'bug-bounty-hunter' package originates from its communication with a domain linked to malicious activities. This connection could lead to unauthorized access to sensitive information, exploitation of user systems, and the potential for further attacks on the infrastructure utilizing this package. The issue was introduced in version 1337.0.0, making it critical for users of this version to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bug-bounty-hunterIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'bug-bounty-hunter' package until a secure version is released. Additionally, consider implementing network security measures to block communications with the malicious domain associated with this package.
Conclusion
The 'bug-bounty-hunter' package has a critical vulnerability that exposes users to potential security risks due to its connection with a malicious domain. It is essential for users to update the package to a secure version and consider implementing workarounds until a fix is available. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for bug-bounty-hunter →
FAQ
The 'bug-bounty-hunter' package is an npm library that helps developers manage and participate in bug bounty programs.
The vulnerability involves the package communicating with a domain linked to malicious activities, posing risks to user data and system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, consider implementing network security measures to block the malicious domain and avoid using the package until a secure version is available.
Detailed information about this vulnerability can be found in the official GitHub repository of the package and through security advisories related to npm packages.
