Malicious Code Detected in Creditorwatch Package (npm) - MAL-2025-6221
Summary
MAL-2025-6221: Malicious code in creditorwatch (npm). Affects creditorwatch versions >= 5.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Creditorwatch is an npm package designed for managing credit and financial data. It provides functionalities for users to interact with credit reporting services and manage their financial health. However, recent analysis has revealed that certain versions of this package contain malicious code that compromises user security.
Vulnerability Detail
The vulnerability stems from the package 'creditorwatch' version 5.0.4 and 5.0.7, which have been identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activities and executes commands that can lead to unauthorized access or data breaches. This poses significant risks to users, including potential data theft and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall creditorwatchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package from your project until a secure version is available. You can do this by executing: npm uninstall creditorwatch.
Conclusion
The creditorwatch package has been flagged for containing malicious code that can compromise user security. It is crucial for developers using this package to update to a secure version or remove it entirely to protect their applications from potential threats.
See every vulnerability recorded for creditorwatch →
FAQ
Versions 5.0.4 and 5.0.7 of the creditorwatch package are identified as malicious.
You should update to the latest version of the creditorwatch package or remove it from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
Using a malicious package can lead to data theft, unauthorized access to your system, and potential damage to your application's integrity.
