Malicious Code Detected in cronedit Package - Security Alert
Summary
MAL-2025-17693: Malicious code in cronedit (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cronedit package is a tool designed for managing cron jobs in Node.js applications. It allows users to easily create, edit, and delete cron jobs programmatically. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users who rely on it for scheduling tasks.
Vulnerability Detail
The vulnerability in the cronedit package originates from the inclusion of malicious code within its source. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other malicious activities. Users of cronedit should be aware that any version starting from 0 is affected, and immediate action is required to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall croneditIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the cronedit package from their project until a secure version is confirmed. This can be done with the command: npm uninstall cronedit. Alternatively, consider using a different package for managing cron jobs that does not have known vulnerabilities.
Conclusion
The discovery of malicious code in the cronedit package poses a serious threat to users. It is crucial to take immediate action by updating or removing the package to safeguard your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cronedit →
FAQ
The cronedit package is used for managing cron jobs in Node.js applications, allowing users to create, edit, and delete scheduled tasks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If you cannot update the package right away, consider uninstalling it and using an alternative package for managing cron jobs until a secure version is available.
Uninstalling cronedit will not cause data loss, but any cron jobs managed by it will need to be recreated using an alternative solution.
More information about this vulnerability can be found on the GitHub repository of the malicious packages project, specifically at the URL: https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cronedit/MAL-2025-17693.json.
