Malicious Code Detected in date-d2w-project Package - Immediate Action Required
Summary
MAL-2025-18022: Malicious code in date-d2w-project (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The date-d2w-project package is an npm library designed for date manipulation and formatting. It is utilized in various JavaScript applications to simplify date-related operations. However, recent findings have revealed that this package contains malicious code that can compromise the security of applications using it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the date-d2w-project package. This code can potentially lead to unauthorized access, data breaches, or other harmful actions within applications that rely on this package. The malicious code was introduced in version 0 and affects all subsequent versions, posing a significant risk to developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall date-d2w-projectIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can replace the date-d2w-project package with a different library that offers similar functionality, such as 'date-fns' or 'moment.js'. You can install one of these alternatives using npm: 'npm install date-fns' or 'npm install moment'.
Conclusion
The discovery of malicious code in the date-d2w-project package poses a serious threat to applications using it. Immediate action is required to uninstall the package and replace it with a secure alternative to protect your application from potential vulnerabilities.
See every vulnerability recorded for date-d2w-project →
FAQ
The date-d2w-project package is an npm library used for date manipulation and formatting in JavaScript applications.
The malicious code can lead to unauthorized access and potential data breaches within applications that utilize the package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
You should immediately uninstall the date-d2w-project package and replace it with a secure alternative.
No, there is no patch available for the date-d2w-project package. The best course of action is to uninstall it.
