Malicious Code Detected in coalesce-generic Package - Security Alert
Summary
MAL-2025-17236: Malicious code in coalesce-generic (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The coalesce-generic package is a utility library in the npm ecosystem that provides a simple way to coalesce values. It is widely used in JavaScript applications for handling undefined or null values. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that depend on it.
Vulnerability Detail
The vulnerability in the coalesce-generic package stems from the inclusion of malicious code that can compromise the integrity of applications using it. This code may lead to unauthorized access, data breaches, or other malicious activities. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall coalesce-genericIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the coalesce-generic package from your project and replacing its functionality with alternative libraries or custom implementations that do not pose security risks.
Conclusion
The discovery of malicious code in the coalesce-generic package highlights the importance of maintaining vigilance in open-source software dependencies. Developers are urged to update their packages promptly and consider using tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for coalesce-generic →
FAQ
coalesce-generic is an npm package that helps developers manage undefined or null values in JavaScript applications.
The malicious code was identified by security researchers from Amazon Inspector, who regularly monitor open-source packages for vulnerabilities.
Using the compromised coalesce-generic package can lead to unauthorized access to sensitive data, application crashes, or exploitation by malicious actors.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
If immediate updates are not possible, consider removing the package and implementing alternative solutions to mitigate the risk until you can perform a proper update.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
