Malicious Code Detected in cbg-log Package - Security Alert
Summary
MAL-2025-16677: Malicious code in cbg-log (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cbg-log package is an npm library designed for logging purposes, providing developers with tools to record and manage log data efficiently. However, it has been identified to contain malicious code, which poses significant security risks to applications utilizing this package. This vulnerability can compromise the integrity of applications and potentially lead to unauthorized access or data breaches.
Vulnerability Detail
The vulnerability in the cbg-log package stems from the inclusion of malicious code that can execute harmful actions within the environment where the package is deployed. This code was introduced in version 0 and can lead to severe consequences, including data theft, unauthorized access to system resources, and overall compromise of application security. Users of this package are at risk of exploitation by attackers leveraging the malicious functionality embedded within the code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cbg-logIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the cbg-log package altogether and implement a different logging solution. For example, you can use the 'winston' package for logging in Node.js applications. Install it using the following command: npm install winston.
Conclusion
The cbg-log package has been identified to contain malicious code, posing significant security risks to applications. It is crucial for developers to remove this package and consider alternative logging solutions to ensure the safety and integrity of their applications.
See every vulnerability recorded for cbg-log →
FAQ
The cbg-log package is an npm library used for logging purposes in Node.js applications.
The malicious code can execute harmful actions, potentially leading to data theft and unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Currently, there is no specific patch available for the cbg-log package. It is recommended to remove the package or switch to an alternative.
Remove the cbg-log package from your project and consider using a different logging library, such as 'winston'.
