Malicious Code Detected in coverage-v8 Package: Version 9.9.9 Compromised
Summary
MAL-2025-5833: Malicious code in coverage-v8 (npm). Affects coverage-v8 versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coverage-v8 package is a tool used in JavaScript applications for code coverage analysis, helping developers understand which parts of their code are being tested. It is widely utilized in the npm ecosystem for its ability to integrate seamlessly with various testing frameworks. However, version 9.9.9 of this package has been identified as malicious, posing significant risks to users who have integrated it into their projects.
Vulnerability Detail
The vulnerability in the coverage-v8 package arises from its malicious behavior, which includes communication with domains linked to harmful activities and the execution of commands that can compromise system integrity. This behavior can lead to unauthorized access, data breaches, and potential exploitation of the affected systems. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which flagged it for its harmful actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall coverage-v8If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patched version available, the best workaround is to avoid using the coverage-v8 package altogether. If your project relies on it, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The coverage-v8 package version 9.9.9 has been flagged as malicious due to its harmful behavior, including unauthorized communication and command execution. Users are advised to uninstall this version and consider alternative packages for code coverage analysis. Monitoring tools like Vulert can help keep your projects secure from such vulnerabilities.
See every vulnerability recorded for coverage-v8 →
FAQ
coverage-v8 is a JavaScript package used for code coverage analysis, helping developers identify untested parts of their code.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged the package for communicating with harmful domains and executing malicious commands.
You should uninstall version 9.9.9 immediately using the command npm uninstall coverage-v8 to mitigate the risk.
Yes, consider using other code coverage tools such as Istanbul or Jest, which do not have known vulnerabilities.
You can use Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check for vulnerabilities using the Vulert playground at Vulert Scanner without needing to sign up.
