Malicious Code Detected in command-module-zenobia-metalsmith Package
Summary
MAL-2025-17404: Malicious code in command-module-zenobia-metalsmith (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The command-module-zenobia-metalsmith package is an npm module designed to facilitate command module functionalities within the Metalsmith static site generator. It allows developers to create modular and reusable components for their projects. However, this package has been identified as containing malicious code, posing a significant risk to users who integrate it into their applications.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the command-module-zenobia-metalsmith package. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other harmful effects. The malicious code was introduced in version 0 and affects all subsequent versions, making it critical for users to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall command-module-zenobia-metalsmithIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the command-module-zenobia-metalsmith package and look for alternative packages that provide similar functionalities without the associated risks.
Conclusion
The command-module-zenobia-metalsmith package has been found to contain malicious code, posing serious security risks to users. Immediate action is required to remove the package and seek alternatives. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for command-module-zenobia-metalsmith →
FAQ
It is an npm module used for creating modular command functionalities in the Metalsmith static site generator.
The malicious code was introduced in version 0 of the package and affects all subsequent versions.
Using this package can lead to unauthorized access, data breaches, and other security vulnerabilities in applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The best course of action is to remove the package entirely. There are no safe workarounds that can fully mitigate the risks associated with this vulnerability.
