Critical Malicious Code Vulnerability in evalist Package
Summary
MAL-2025-19921: Malicious code in evalist (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The evalist package is an npm module designed for evaluating JavaScript expressions. It is commonly used in various applications for dynamic code execution. However, due to its functionality, it can be susceptible to malicious code injection, which poses significant security risks to applications relying on it.
Vulnerability Detail
The evalist package has been identified to contain malicious code that can be exploited by attackers. This vulnerability originated from the package's codebase, which was compromised, allowing unauthorized execution of harmful scripts. The ramifications of this vulnerability include potential data breaches, unauthorized access to sensitive information, and the ability to execute arbitrary code within the application context.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall evalistIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the evalist package from your project until a secure version is available. You can do this by executing: npm uninstall evalist.
Conclusion
The evalist package has a critical vulnerability due to malicious code that can compromise applications. It is essential to update the package to a secure version or remove it until a fix is implemented. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for evalist →
FAQ
The evalist package is used for evaluating JavaScript expressions dynamically within applications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
The risks include unauthorized access to sensitive data, execution of arbitrary code, and potential data breaches.
Yes, a patched version of the evalist package is available. Updating to this version will resolve the vulnerability.
If you cannot update the package, consider removing it from your project as a temporary measure until a secure version is available.
