Malicious Code Detected in Eventfeed Package - Vulnerability MAL-2025-19928
Summary
MAL-2025-19928: Malicious code in eventfeed (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Eventfeed package is an npm library designed for managing and processing event feeds in JavaScript applications. It provides functionalities for real-time event handling, making it a popular choice among developers for building interactive applications. However, the package has been found to contain malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability identified as MAL-2025-19928 originates from the Eventfeed package, which has been compromised to include malicious code. This code can potentially lead to unauthorized access, data breaches, or other harmful actions within applications that utilize the package. The malicious nature of this code means that any application relying on Eventfeed could be at risk, making it imperative for developers to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eventfeedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the Eventfeed package from your project until a secure version is released. You can do this by executing: npm uninstall eventfeed. This will help mitigate the risk of exposure to the malicious code.
Conclusion
The discovery of malicious code in the Eventfeed package highlights the importance of vigilance in managing open-source dependencies. Developers are urged to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in real-time. By taking these steps, you can help safeguard your applications against potential threats.
See every vulnerability recorded for eventfeed →
FAQ
Eventfeed is an npm library used for managing event feeds in JavaScript applications, allowing developers to handle real-time events efficiently.
This vulnerability indicates that the Eventfeed package contains malicious code that can compromise the security of applications using it.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your package-lock.json file, it alerts you to any vulnerabilities, including MAL-2025-19928.
Yes, you can temporarily uninstall the Eventfeed package from your project to avoid exposure to the malicious code.
Utilize tools like Vulert to monitor your dependencies for vulnerabilities. You can also regularly check the repositories of your packages for updates and security advisories.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
