Malicious Code Alert in drive-sdk: Security Risk Identified
Summary
MAL-2025-6283: Malicious code in drive-sdk (npm). Affects drive-sdk versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drive-sdk package is an npm library designed to facilitate interactions with various cloud storage services. It offers functionalities such as file management, data retrieval, and user authentication. However, recent findings have revealed that this package communicates with a domain linked to malicious activities, posing a significant security risk to applications utilizing it.
Vulnerability Detail
The vulnerability in the drive-sdk package stems from its communication with a domain associated with malicious activity. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications that rely on this package. The issue was introduced in version 1.0.0 and remains unaddressed in subsequent releases, making it critical for developers to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall drive-sdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the drive-sdk package from your project until a secure version is released. You can uninstall it using the following command: npm uninstall drive-sdk. Additionally, monitor your application for any unusual activity that may arise from the use of this package.
Conclusion
The drive-sdk package has been identified as having a critical vulnerability due to its communication with a malicious domain. Developers are urged to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for drive-sdk →
FAQ
The drive-sdk package is an npm library that allows developers to interact with cloud storage services for file management and data retrieval.
The package communicates with a domain linked to malicious activities, which could lead to data breaches or unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it alerts you to any vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup or installation.
If an immediate update is not possible, consider removing the package temporarily and monitoring your application for any suspicious activity.
