Malicious Code Detected in compile-dog-resolve-java-slow Package
Summary
MAL-2025-17448: Malicious code in compile-dog-resolve-java-slow (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The compile-dog-resolve-java-slow package is an npm library designed to facilitate Java integration within JavaScript applications. It aims to streamline the process of resolving Java dependencies in a Node.js environment. However, this package has been identified to contain malicious code, posing significant risks to users who incorporate it into their projects.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the compile-dog-resolve-java-slow package. This code can lead to unauthorized access, data breaches, or system compromise, potentially allowing attackers to execute harmful actions on the user's system. The malicious nature of this code was confirmed by security researchers, raising concerns about the integrity and security of applications utilizing this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall compile-dog-resolve-java-slowIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar functionality without the associated risks. Ensure to review the security posture of any new packages before integration.
Conclusion
The compile-dog-resolve-java-slow package has been found to contain malicious code, posing serious security risks to users. It is essential to remove this package from your projects and consider alternatives. Regularly monitoring your dependencies with tools like Vulert can help you stay informed about vulnerabilities.
See every vulnerability recorded for compile-dog-resolve-java-slow →
FAQ
It is an npm library designed to help JavaScript applications resolve Java dependencies.
Security researchers identified the malicious code during routine audits of npm packages.
Using this package can lead to unauthorized access, data breaches, and potential system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Immediately uninstall the package and consider using alternative solutions while monitoring for any updates or patches.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
