Malicious Code Detected in create-shop-mini Package - Security Alert
Summary
MAL-2025-17665: Malicious code in create-shop-mini (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The create-shop-mini package is an npm library designed to facilitate the creation of mini e-commerce shops. It offers features such as product management, user authentication, and payment processing. However, recent findings have revealed that this package contains malicious code, posing a significant security risk to users who integrate it into their applications.
Vulnerability Detail
The vulnerability in the create-shop-mini package originates from the inclusion of malicious code that can compromise the security of applications using this library. The malicious code could potentially lead to unauthorized access, data breaches, or the execution of harmful operations within the user's environment. This vulnerability affects all versions of the package starting from its introduction, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall create-shop-miniIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the create-shop-mini package and instead implement custom solutions for e-commerce functionalities or utilize other reputable packages that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the create-shop-mini package poses a serious threat to users. It is essential to take immediate action by removing the package and seeking secure alternatives. Regularly monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for create-shop-mini →
FAQ
create-shop-mini is an npm package designed for building mini e-commerce shops with features like product management and payment processing.
The malicious code can lead to unauthorized access and potential data breaches, compromising the security of applications that use this package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your package-lock.json file, you can check for vulnerabilities without any installation.
The best mitigation strategy is to remove the create-shop-mini package and replace it with a secure alternative. Always keep your dependencies updated.
Detailed information about the vulnerability can be found on the GitHub repository of the malicious packages project or through security advisories related to npm packages.
