Malicious Code Detected in dagger-core: A Critical Vulnerability
Summary
MAL-2025-6920: Malicious code in dagger-core (npm). Affects dagger-core versions >= 13.8.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dagger-core package is an npm library designed to facilitate dependency injection in JavaScript applications. It is widely used for its ability to manage object creation and lifecycle, promoting cleaner and more maintainable code. However, version 13.8.9 of dagger-core has been flagged for malicious activity, raising concerns about its integrity and the security of applications relying on it.
Vulnerability Detail
The vulnerability in dagger-core arises from its communication with a domain associated with malicious activities. This behavior indicates that the package may execute commands that could compromise the security of the host application. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which highlighted the risks associated with using this specific version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dagger-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the dagger-core package from your project until a secure version can be implemented. You can do this by executing: npm uninstall dagger-core.
Conclusion
The dagger-core package version 13.8.9 has been identified as malicious due to its association with harmful activities. It is crucial for developers using this package to update to a secure version or remove it from their projects to safeguard their applications. Continuous monitoring with tools like Vulert can help maintain security in open-source dependencies.
See every vulnerability recorded for dagger-core →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, potentially executing harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can uninstall the dagger-core package to prevent any potential security risks.
The vulnerability was identified by the OpenSSF Package Analysis project, which focuses on analyzing and reporting on package security.
Yes, using tools like Vulert allows you to monitor your project's dependencies for vulnerabilities in real-time, ensuring you stay informed.
