Malicious Code Detected in csirtg Package - Immediate Action Required
Summary
MAL-2025-17779: Malicious code in csirtg (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The csirtg package is an npm library designed for cybersecurity threat intelligence, providing users with tools and resources to enhance their security posture. However, it has recently been identified as containing malicious code, posing significant risks to users who integrate it into their applications.
Vulnerability Detail
The csirtg package has been found to harbor malicious code that can compromise the security of applications utilizing it. This vulnerability originated from the package itself, which was introduced in version 0 and has the potential to execute harmful actions on affected systems. Users of this package are at risk of data breaches, unauthorized access, and other security incidents due to this malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall csirtgIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider replacing the csirtg package with an alternative library that provides similar functionality without the associated risks. Ensure to thoroughly vet any replacement package for security vulnerabilities before integration.
Conclusion
The csirtg package has been identified as containing malicious code, which poses serious security risks to applications using it. Users are advised to remove the package and monitor for updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your software.
See every vulnerability recorded for csirtg →
FAQ
The csirtg package is an npm library focused on cybersecurity threat intelligence, offering tools for enhancing security measures.
The malicious code can execute harmful actions, potentially leading to data breaches and unauthorized access to systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no patched version available. It is recommended to remove the package until a secure version is released.
Immediately remove the csirtg package from your project and consider using an alternative library that does not pose security risks.
