Critical Malicious Activity Detected in dot-net-interactive-kernels Package
Summary
MAL-2025-5811: Malicious code in dot-net-interactive-kernels (npm). Affects dot-net-interactive-kernels versions >= 90.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dot-net-interactive-kernels package is an npm library designed to facilitate interactive coding experiences with .NET languages. It allows users to run .NET code in a notebook-style interface, making it popular among developers and data scientists. However, this package has been identified as having a vulnerability that exposes users to potential malicious activities due to its communication with a harmful domain.
Vulnerability Detail
The vulnerability in the dot-net-interactive-kernels package arises from its communication with a domain associated with malicious activity. This could lead to unauthorized access, data breaches, or the execution of harmful code on the user's system. The issue was introduced in version 90.99.99, and it poses significant risks to users who rely on this package for their development work.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dot-net-interactive-kernelsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the dot-net-interactive-kernels package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The dot-net-interactive-kernels package has a critical vulnerability that exposes users to malicious activities. It is essential to update the package to a secure version and consider alternative solutions until a fix is implemented. Regular monitoring for vulnerabilities is crucial for maintaining software security.
See every vulnerability recorded for dot-net-interactive-kernels →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise user security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update isn't possible, refrain from using the package and look for alternative solutions until a secure version is available.
While specific exploits have not been detailed, the nature of the vulnerability suggests potential for unauthorized access and data breaches.
Regularly check for vulnerabilities, especially after updates or when new vulnerabilities are reported. Tools like Vulert can help automate this process.
