Malicious Code Detected in dds-js Package - Security Alert
Summary
MAL-2025-5808: Malicious code in dds-js (npm). Affects dds-js versions >= 2.3.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The dds-js package is an npm library designed for data distribution services, enabling efficient communication between applications. It is widely used in various projects for its capabilities in handling real-time data streams. However, recent findings have revealed that this package has been compromised, allowing it to communicate with a domain linked to malicious activities, posing a significant security risk to users.
Vulnerability Detail
The vulnerability in the dds-js package originates from version 2.3.9, where the package has been found to communicate with a domain associated with malicious activities. This could lead to unauthorized data access, data exfiltration, or other harmful actions against users' systems. The presence of such malicious code can severely compromise the integrity and security of applications relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dds-jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the dds-js package until a secure version is released. Alternatively, consider using a different package that offers similar functionality without the associated risks.
Conclusion
In summary, the dds-js package has been identified as having a serious vulnerability that allows communication with a malicious domain. Users are strongly advised to update to a patched version or consider alternative solutions to mitigate potential risks. Utilizing tools like Vulert can enhance your ability to monitor and respond to such vulnerabilities effectively.
See every vulnerability recorded for dds-js →
FAQ
dds-js is an npm library used for data distribution services, facilitating real-time communication between applications.
The vulnerability allows the dds-js package to communicate with a malicious domain, potentially leading to unauthorized access and data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider using alternative packages that provide similar functionality without the security risks.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file, ensuring your applications remain secure.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
