Malicious Code Detected in bullyshitty (npm) - Version 3.0.0
Summary
MAL-2025-6383: Malicious code in bullyshitty (npm). Affects bullyshitty versions 3.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'bullyshitty' package is an npm module that may be used for various functionalities in JavaScript applications. However, it has been identified as malicious in version 3.0.0 due to its ability to communicate with domains linked to harmful activities and execute commands that can compromise system integrity. This vulnerability raises significant concerns for developers relying on this package for their projects.
Vulnerability Detail
The vulnerability in the 'bullyshitty' package arises from its malicious behavior, which includes communicating with a domain associated with malicious activities and executing harmful commands. This behavior can lead to unauthorized access, data breaches, and potential system compromise, making it critical for users of this package to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bullyshittyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider replacing 'bullyshitty' with a safer alternative package that provides similar functionality. Review your project's dependencies and ensure that you are not relying on any malicious packages. Regularly audit your package-lock.json file to identify and address vulnerabilities.
Conclusion
The identification of malicious code in the 'bullyshitty' package underscores the importance of vigilance in managing open-source dependencies. Developers should take immediate action to remove this package and consider safer alternatives to protect their applications from potential threats.
See every vulnerability recorded for bullyshitty →
FAQ
The 'bullyshitty' package is an npm module that has been identified as malicious due to its harmful behavior, including executing commands and communicating with malicious domains.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If you have installed 'bullyshitty', you should uninstall it immediately using 'npm uninstall bullyshitty' and look for alternative packages.
While specific alternatives depend on the functionality you need, consider searching the npm registry for packages that offer similar features without the associated risks.
To prevent similar vulnerabilities, regularly audit your dependencies, keep your packages updated, and utilize tools like Vulert to monitor for vulnerabilities in real-time.
