Critical Malicious Code Vulnerability in creators-sdk Package
Summary
MAL-2025-17668: Malicious code in creators-sdk (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The creators-sdk package is a JavaScript library designed for developers to create and manage content across various platforms. It provides functionalities such as content creation, user management, and integration with different APIs. However, this package has been found to contain malicious code that poses significant security risks to applications utilizing it.
Vulnerability Detail
The vulnerability in the creators-sdk package originates from the inclusion of malicious code that can compromise the security of applications. This code may allow unauthorized access to sensitive data, execute arbitrary commands, or facilitate other malicious activities. The vulnerability affects all versions starting from 0, making it critical for users to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall creators-sdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to remove the creators-sdk package from their projects until a secure version is released. You can uninstall the package using the command: 'npm uninstall creators-sdk'. This will help prevent any potential exploitation of the vulnerability.
Conclusion
The creators-sdk package has been identified to contain malicious code, posing a serious security threat to applications using it. Immediate action is required to update or uninstall the package to protect against potential exploitation. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for creators-sdk →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data and execute harmful commands within the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, it is recommended to uninstall the creators-sdk package to mitigate risks until a secure version is available.
While specific exploits have not been publicly disclosed, the nature of the malicious code suggests that it could be leveraged for various attacks, including data theft and unauthorized access.
You can monitor the package repository on GitHub or subscribe to notifications for updates related to the creators-sdk package.
