Malicious Code Detected in cam-isol Package - Security Alert
Summary
MAL-2025-16471: Malicious code in cam-isol (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cam-isol package is an npm library designed for isolating and managing camera streams in web applications. It provides developers with tools to handle video input efficiently. However, it has been found to contain malicious code that poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the cam-isol package originates from the inclusion of malicious code that can compromise the security of applications using this library. This code may allow unauthorized access to sensitive data or enable remote code execution, leading to potential data breaches or system compromises. The issue affects all versions starting from 0, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cam-isolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the cam-isol package from your project until a secure version is released. You can do this by executing the following command: 'npm uninstall cam-isol'. This will help mitigate the risk of exposure to the malicious code.
Conclusion
The cam-isol package has been identified as containing malicious code that poses significant security risks. Users are strongly encouraged to update or uninstall the package until a secure version is available. Utilizing tools like Vulert can help monitor for vulnerabilities in your application effectively.
See every vulnerability recorded for cam-isol →
FAQ
The cam-isol package is used for managing and isolating camera streams in web applications, providing developers with tools for efficient video input handling.
The malicious code can potentially allow unauthorized access to sensitive data or enable remote code execution, posing serious security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can identify if your application is affected. Visit the Vulert playground at Vulert Scanner to test your application without any signup.
Currently, there is no patched version available. Users are advised to monitor the official repository for updates and apply them as soon as they are released.
If immediate updates are not possible, consider uninstalling the cam-isol package to mitigate risks until a secure version is released.
