Critical Malicious Code Vulnerability in congqian Package
Summary
MAL-2025-17486: Malicious code in congqian (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The congqian package is an npm library that serves various functionalities within JavaScript applications. It is designed to facilitate specific tasks, but its recent discovery of malicious code poses significant risks to users. The package is widely used in the npm ecosystem, making it crucial for developers to be aware of its vulnerabilities.
Vulnerability Detail
The congqian package has been identified to contain malicious code that can compromise the security of applications utilizing it. This vulnerability originates from the package itself, which was introduced in version 0 and has not been addressed in subsequent releases. The ramifications of this vulnerability include potential data breaches, unauthorized access to sensitive information, and the ability for attackers to execute arbitrary code within affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall congqianIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that offer similar functionalities without the associated risks. Review your project's dependencies and replace congqian with a secure alternative until a fix is released.
Conclusion
The discovery of malicious code in the congqian npm package poses a significant threat to users. It is crucial to take immediate action by uninstalling the package and seeking alternatives. Continuous monitoring for updates and utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for congqian →
FAQ
The congqian package is an npm library used in JavaScript applications for various functionalities.
The vulnerability involves malicious code that can compromise application security.
You can use Vulert to monitor and alert for vulnerabilities in your application by analyzing your package-lock.json file.
Yes, you can uninstall the congqian package and replace it with a secure alternative until a patch is available.
Detailed information can be found in the vulnerability report on GitHub and through security advisories.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
