Malicious Code Detected in cosmicmind-graphjs Package
Summary
MAL-2025-17608: Malicious code in cosmicmind-graphjs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cosmicmind-graphjs package is a JavaScript library used for graph visualization and manipulation. It provides developers with tools to create interactive and dynamic graph representations in web applications. However, this package has been found to contain malicious code that could compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability in the cosmicmind-graphjs package stems from the inclusion of malicious code that can execute harmful actions on the user's system. This code was introduced in version 0 and poses significant risks, including data theft, unauthorized access, and potential system compromise. The malicious nature of this code makes it imperative for users to take immediate action to protect their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cosmicmind-graphjsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can remove the cosmicmind-graphjs package from their project until a secure version is released. This can be done by executing the following command: npm uninstall cosmicmind-graphjs. Consider using alternative libraries for graph visualization in the meantime.
Conclusion
The discovery of malicious code in the cosmicmind-graphjs package poses a serious threat to applications that utilize it. Immediate action is required to update or remove the package to safeguard against potential security breaches. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for cosmicmind-graphjs →
FAQ
cosmicmind-graphjs is a JavaScript library designed for creating interactive graph visualizations in web applications.
The malicious code can execute harmful actions on the user's system, potentially leading to data theft or unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
It is recommended to check the official repository for any patched versions of cosmicmind-graphjs and update accordingly.
As a temporary measure, consider uninstalling the cosmicmind-graphjs package and using alternative libraries for graph visualization.
