Critical Malicious Code Vulnerability in erpserver Package
Summary
MAL-2025-19789: Malicious code in erpserver (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The erpserver package is a Node.js application designed for enterprise resource planning (ERP) solutions. It offers functionalities such as inventory management, order processing, and customer relationship management. However, the package has been identified to contain malicious code, posing significant risks to users and their data security.
Vulnerability Detail
The vulnerability in the erpserver package stems from the inclusion of malicious code that can compromise the integrity of the application. This code may allow unauthorized access to sensitive data, lead to data breaches, or enable the execution of harmful operations within the user's environment. The issue affects all versions of the package starting from version 0, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall erpserverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users may consider removing the erpserver package from their projects until a secure version is released. This can be done using the command: 'npm uninstall erpserver'. Additionally, users should review their application for any signs of compromise.
Conclusion
The erpserver package contains a critical vulnerability due to malicious code that can severely impact users. It is essential to take immediate action by updating or uninstalling the package to protect your application and data. Utilizing tools like Vulert can help monitor your projects for vulnerabilities in real-time.
See every vulnerability recorded for erpserver →
FAQ
The erpserver package is a Node.js application that provides enterprise resource planning functionalities, including inventory and order management.
The malicious code can compromise application integrity, potentially leading to unauthorized data access and execution of harmful operations.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider uninstalling the package and reviewing your application for any signs of compromise.
Regularly check vulnerability databases and consider using tools like Vulert to receive real-time alerts for any new vulnerabilities in your dependencies.
