Malicious Code Detected in bundle-minify-query-void-java Package
Summary
MAL-2025-16342: Malicious code in bundle-minify-query-void-java (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bundle-minify-query-void-java package is an npm module designed to assist developers in optimizing and minifying Java applications. It aims to streamline the development process by reducing file sizes and improving load times. However, this package has been found to contain malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability in the bundle-minify-query-void-java package arises from the inclusion of malicious code that can compromise the security of applications utilizing this package. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious nature of this code was identified through security assessments, highlighting the importance of scrutinizing third-party packages before integration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bundle-minify-query-void-javaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative packages that provide similar functionality without the associated risks. Review your project's dependencies and replace the bundle-minify-query-void-java package with a trusted alternative until a secure version is available.
Conclusion
The discovery of malicious code in the bundle-minify-query-void-java package underscores the importance of vigilance when using third-party libraries. Users are encouraged to remove the affected package and monitor their dependencies for vulnerabilities to maintain the security of their applications.
See every vulnerability recorded for bundle-minify-query-void-java →
FAQ
It is an npm module designed to optimize and minify Java applications, enhancing performance by reducing file sizes.
The malicious code was identified through security assessments conducted by Amazon Inspector, which flagged the package for containing harmful elements.
Using this package can lead to unauthorized access, data breaches, and other security vulnerabilities within your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
