Malicious Code Detected in easyupnp Package - MAL-2025-19097
Summary
MAL-2025-19097: Malicious code in easyupnp (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The easyupnp package is a Node.js library designed to facilitate Universal Plug and Play (UPnP) functionalities, allowing applications to discover and interact with network devices seamlessly. It is commonly used in IoT applications and home automation systems. However, this package has been found to contain malicious code, posing significant security risks to users and their systems.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the easyupnp package, which was introduced in version 0 and affects all subsequent versions. This malicious code can lead to unauthorized access, data breaches, and potential exploitation of the systems utilizing this package. Users of easyupnp are at risk of having their applications compromised, which could result in severe consequences such as data loss or unauthorized control over network devices.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall easyupnpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the easyupnp package from their project until a secure version is released. This can be done with the following command: npm uninstall easyupnp. Consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The easyupnp package has been identified as containing malicious code, which poses significant risks to users. It is crucial to update to a secure version or remove the package entirely to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for easyupnp →
FAQ
easyupnp is a Node.js library that enables applications to discover and interact with UPnP devices on a network.
The malicious code can lead to unauthorized access and exploitation of systems using the easyupnp package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, consider uninstalling the easyupnp package and using alternative libraries until a secure version is available.
Detailed information about this vulnerability can be found on the GitHub repository of the malicious packages project.
