Malicious Code Detected in Congrs Package: A Critical Security Alert
Summary
MAL-2025-17487: Malicious code in congrs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'congrs' package is an npm library designed for specific functionalities within JavaScript applications. It is utilized by developers for various tasks, but its recent discovery of malicious code poses significant risks. This vulnerability can compromise the integrity of applications that rely on this package, making it crucial for users to be aware of its implications.
Vulnerability Detail
The 'congrs' package has been identified to contain malicious code, which can lead to unauthorized access, data breaches, or other harmful actions within applications that utilize it. This vulnerability originated from the package itself, and its presence can severely impact the security posture of any project that includes it. Developers should be vigilant about the potential ramifications of using this compromised package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall congrsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the 'congrs' package from your project until a secure version is released. You can do this by executing: 'npm uninstall congrs'. This will help mitigate the risk associated with the malicious code.
Conclusion
The discovery of malicious code in the 'congrs' package highlights the importance of maintaining secure dependencies in software projects. Users are urged to take immediate action by updating or removing the package to safeguard their applications.
See every vulnerability recorded for congrs →
FAQ
The 'congrs' package is an npm library used in JavaScript applications for various functionalities, but it has recently been found to contain malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you are using 'congrs', you should update the package to the latest version or remove it from your project until a secure version is available.
Using a compromised package can lead to unauthorized access, data breaches, and other security vulnerabilities that can affect your application and its users.
More information can be found in the vulnerability report on GitHub at https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/congrs/MAL-2025-17487.json.
