Malicious Code Detected in delta-eta-encrypt-node-thread Package
Summary
MAL-2025-18219: Malicious code in delta-eta-encrypt-node-thread (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The delta-eta-encrypt-node-thread package is an npm library designed for encryption tasks in Node.js applications. It offers functionalities that allow developers to securely encrypt and decrypt data using various algorithms. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the delta-eta-encrypt-node-thread package. This code can potentially compromise the integrity and confidentiality of the data processed by applications using this package. The ramifications include unauthorized access to sensitive information, data manipulation, and the possibility of further exploitation of the affected systems. It is crucial for developers to be aware of this issue to safeguard their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall delta-eta-encrypt-node-threadIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider using alternative encryption libraries that are known to be secure and actively maintained. For example, you can use the 'crypto' module built into Node.js for encryption tasks. Here is a sample code snippet to encrypt data using the 'crypto' module:
const crypto = require('crypto');
const algorithm = 'aes-256-cbc';
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);
function encrypt(text) {
let cipher = crypto.createCipheriv(algorithm, Buffer.from(key), iv);
let encrypted = cipher.update(text);
encrypted = Buffer.concat([encrypted, cipher.final()]);
return encrypted.toString('hex');
}
const encryptedData = encrypt('Sensitive Data');
console.log(encryptedData);
Conclusion
The delta-eta-encrypt-node-thread package has been identified to contain malicious code, posing serious security risks to applications. It is essential for developers to take immediate action by removing the package and considering secure alternatives. Utilizing tools like Vulert can aid in monitoring vulnerabilities effectively.
See every vulnerability recorded for delta-eta-encrypt-node-thread →
FAQ
It is an npm library used for encryption tasks in Node.js applications.
The package contains code that can compromise data integrity and confidentiality.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Remove the package and consider using a secure alternative or update to a patched version if available.
Vulert uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities, ensuring your software remains secure.
