Malicious Code Detected in deimos-writable-miranda-got: A Critical Security Alert
Summary
MAL-2025-18183: Malicious code in deimos-writable-miranda-got (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'deimos-writable-miranda-got' is an npm module designed for specific functionalities within JavaScript applications. It is utilized for various tasks, but recent findings have revealed that it contains malicious code, posing significant security risks to applications that depend on it. Users of this package should be aware of its potential vulnerabilities and take immediate action to safeguard their systems.
Vulnerability Detail
The vulnerability in 'deimos-writable-miranda-got' originates from the inclusion of malicious code within the package. This code can lead to unauthorized access, data breaches, and potential exploitation of the systems utilizing this package. The malicious nature of the code means that it can perform harmful actions without the user's consent, making it critical for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall deimos-writable-miranda-gotIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider replacing 'deimos-writable-miranda-got' with an alternative package that provides similar functionality without the associated risks. Ensure that any replacement package is thoroughly vetted for security.
Conclusion
The discovery of malicious code in the 'deimos-writable-miranda-got' package highlights the importance of maintaining vigilance in software dependencies. Developers must act swiftly to remove or update affected packages to protect their applications from potential threats.
See every vulnerability recorded for deimos-writable-miranda-got →
FAQ
The malicious code can perform unauthorized actions, potentially leading to data breaches and system exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate removal is not possible, consider implementing strict access controls and monitoring for unusual activity until you can safely remove the package.
While specific exploits may not be publicly documented, the presence of malicious code indicates a high risk of exploitation.
Regularly check for vulnerabilities, ideally on a weekly basis, and always after adding new dependencies or updating existing ones.
