Critical Malicious Code Vulnerability in dedupe-chunks-webpack-plugin
Summary
MAL-2025-18171: Malicious code in dedupe-chunks-webpack-plugin (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dedupe-chunks-webpack-plugin is an npm package designed to optimize Webpack builds by deduplicating chunks in the output. It helps developers streamline their build process, reducing redundancy and improving performance. However, this package has been identified to contain malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the dedupe-chunks-webpack-plugin package. This code can potentially compromise the security of applications that depend on it, leading to unauthorized access, data breaches, or other malicious activities. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dedupe-chunks-webpack-pluginIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the dedupe-chunks-webpack-plugin from your project until a safe version is available. Use the following command to uninstall the package: npm uninstall dedupe-chunks-webpack-plugin.
Conclusion
The dedupe-chunks-webpack-plugin has been identified as containing malicious code, posing a serious threat to applications using it. Immediate action is required to update or remove the package to safeguard your application from potential risks.
See every vulnerability recorded for dedupe-chunks-webpack-plugin →
FAQ
It is an npm package that optimizes Webpack builds by deduplicating chunks, enhancing performance and reducing redundancy.
The malicious code was found in the package starting from version 0, affecting all subsequent versions.
Using this package can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json. Check your application for vulnerabilities at Vulert Scanner.
Yes, you can use the Vulert playground at Vulert Scanner without signing up to check if your application is affected by this vulnerability.
