Critical Malicious Code Vulnerability in donotinstallthis Package
Summary
MAL-2025-18642: Malicious code in donotinstallthis (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The donotinstallthis package is an npm module that was designed for demonstration purposes. It is not intended for production use and is often used in educational contexts. However, this package has been found to contain malicious code, making it a significant security risk for any application that inadvertently includes it as a dependency.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the donotinstallthis package. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other malicious activities. The malicious nature of the code poses a severe risk, especially for applications that handle sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall donotinstallthisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Ensure that your application does not depend on donotinstallthis to avoid potential security risks.
Conclusion
The donotinstallthis package poses a significant security risk due to its malicious code. It is crucial to remove this package from any projects to protect against potential vulnerabilities. Utilizing tools like Vulert can help ensure your application remains secure from such threats.
See every vulnerability recorded for donotinstallthis →
FAQ
The donotinstallthis package is an npm module created for demonstration purposes, but it has been found to contain malicious code.
You can check your package.json and package-lock.json files for any references to donotinstallthis. Additionally, using tools like Vulert can help monitor your dependencies for vulnerabilities.
Using donotinstallthis can lead to unauthorized access, data breaches, and other malicious activities due to the embedded malicious code.
No, the only way to mitigate the risk is to completely remove the donotinstallthis package from your project.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for donotinstallthis.
