Malicious Code Detected in consul-hcp Package - Immediate Action Required
Summary
MAL-2025-17501: Malicious code in consul-hcp (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The consul-hcp package is a Node.js library designed to facilitate communication with HashiCorp's Consul service. It provides developers with tools to manage service discovery and configuration. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the consul-hcp package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code may allow unauthorized access to sensitive data, facilitate remote code execution, or lead to other malicious activities. The issue originated from the package's version 0 and affects all subsequent versions, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall consul-hcpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the consul-hcp package from your project until a secure version is released. You can do this by running the command: 'npm uninstall consul-hcp'. This will help mitigate the risk of exposure to the malicious code.
Conclusion
The discovery of malicious code in the consul-hcp package poses a serious threat to applications utilizing this library. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Regular monitoring of dependencies using tools like Vulert can help prevent future vulnerabilities.
See every vulnerability recorded for consul-hcp →
FAQ
The consul-hcp package is a Node.js library used for interacting with HashiCorp's Consul service, primarily for service discovery and configuration management.
The malicious code found in the consul-hcp package can potentially allow unauthorized access to sensitive data and facilitate remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package right away, consider removing it from your project as a temporary measure to mitigate risks.
Detailed information about this vulnerability can be found in the GitHub repository of the malicious packages project at https://github.com/ossf/malicious-packages.
