Malicious Code Detected in date-fns-2 Package: A Critical Security Alert
Summary
MAL-2025-6086: Malicious code in date-fns-2 (npm). Affects date-fns-2 versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The date-fns-2 package is a popular JavaScript library used for date manipulation and formatting in web applications. It provides a comprehensive set of functions to handle dates effectively, making it a go-to choice for developers. However, recent findings have revealed that this package is compromised, communicating with a domain linked to malicious activities, which poses a significant risk to applications utilizing it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6086 originates from the date-fns-2 package, which has been found to communicate with a domain associated with malicious activity. This could potentially lead to unauthorized data access, data breaches, or the execution of harmful scripts within applications that rely on this package. The issue affects all versions starting from 1.0.0, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall date-fns-2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the date-fns-2 package from your project until a secure version is available. You can do this by executing: npm uninstall date-fns-2. This will prevent any potential malicious activity while you seek a safe alternative or wait for a patch.
Conclusion
The discovery of malicious code in the date-fns-2 package highlights the importance of maintaining vigilance in software dependencies. Developers are urged to update their packages promptly and utilize tools like Vulert to monitor vulnerabilities effectively.
See every vulnerability recorded for date-fns-2 →
FAQ
date-fns-2 is a JavaScript library for manipulating and formatting dates in web applications.
This vulnerability involves the package communicating with a domain linked to malicious activities, posing security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, consider uninstalling the package as a temporary measure to mitigate risks.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file, ensuring your applications remain secure.
