Malicious Code Detected in change-object-path Package
Summary
MAL-2025-16781: Malicious code in change-object-path (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The change-object-path package is a utility in the npm ecosystem that allows developers to manipulate object paths dynamically. It is commonly used in JavaScript applications to modify nested object properties. However, this package has been found to contain malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the change-object-path package originates from the inclusion of malicious code that can compromise the security of applications using this package. This code can lead to unauthorized access, data manipulation, or even complete system compromise. The issue affects all versions starting from 0, making it critical for developers to address it immediately.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall change-object-pathIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the change-object-path package from your project and replacing it with a secure alternative that provides similar functionality. Always ensure to review the security of any new packages before integration.
Conclusion
The change-object-path package has been identified as containing malicious code, posing a significant risk to applications that utilize it. Developers are urged to update to a secure version or find alternatives to mitigate potential threats.
See every vulnerability recorded for change-object-path →
FAQ
The change-object-path package is a JavaScript utility that allows developers to dynamically change properties within nested objects.
The malicious code was introduced in the package itself, affecting all versions from 0 onwards.
Using the affected package can lead to unauthorized access, data breaches, and potential system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. You can also check for vulnerabilities using the Vulert playground without any signup.
If an immediate update is not possible, consider removing the package and using a secure alternative while reviewing the security of any new packages.
