Malicious Code Injection in db-evo Package: A Critical Security Threat
Summary
MAL-2025-47400: Malicious code in db-evo (npm). Affects db-evo versions 1.1.4 – 1.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The db-evo package is an npm library designed for database evolution management, allowing developers to manage and apply database schema changes efficiently. It is widely used in various applications for its ease of use and integration capabilities. However, the package has recently been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability stems from a compromise of the db-evo package by the Shai-Hulud NPM worm. This malicious payload is designed to steal tokens and credentials from users and subsequently publish them to GitHub. Additionally, it propagates itself to other npm packages owned by the affected user, potentially leading to widespread exploitation and data breaches. The malicious code is embedded within versions 1.1.4 and 1.1.5 of the package, making it imperative for users to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall db-evoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the db-evo package from their project until a secure version is available. This can be done using the command: npm uninstall db-evo. Additionally, consider using alternative packages for database management that have not been compromised.
Conclusion
The db-evo package has been compromised, introducing a serious vulnerability that can lead to data theft and further exploitation. Users must take immediate action to update or remove the package to protect their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for db-evo →
FAQ
db-evo is an npm package used for managing database schema changes in applications.
The package was compromised by the Shai-Hulud NPM worm, which injected malicious code into specific versions.
The malicious code can steal sensitive tokens and credentials, leading to potential data breaches and unauthorized access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider removing the package or using alternative solutions until a secure version is released.
