Malicious Code Detected in cli-plugin-script: A Critical Security Alert
Summary
MAL-2025-17115: Malicious code in cli-plugin-script (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cli-plugin-script package is an npm module designed to facilitate script execution within command-line interfaces. It is commonly used in various JavaScript projects to enhance functionality and streamline development processes. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the cli-plugin-script package stems from the inclusion of malicious code that can compromise the integrity of applications utilizing this package. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious nature of this vulnerability was identified in version 0 and has the potential to affect all subsequent versions unless addressed promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cli-plugin-scriptIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the cli-plugin-script package from their project until a secure version is released. This can be done by executing the command: npm uninstall cli-plugin-script. This will prevent any potential exploitation of the malicious code until a fix is available.
Conclusion
The discovery of malicious code in the cli-plugin-script package highlights the importance of maintaining vigilance regarding open-source dependencies. Users are urged to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for cli-plugin-script →
FAQ
cli-plugin-script is an npm package that allows users to execute scripts in command-line interfaces, enhancing the functionality of JavaScript projects.
The malicious code was discovered by Amazon Inspector, which identified the security risk associated with the cli-plugin-script package.
Using the compromised cli-plugin-script package can lead to unauthorized access, data breaches, and potential harm to the integrity of your applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider uninstalling the cli-plugin-script package as a temporary measure to mitigate risks until a secure version is available.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
