Critical Malicious Code Vulnerability in evergreen-yonder-dhh073-project (npm)
Summary
MAL-2025-19988: Malicious code in evergreen-yonder-dhh073-project (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The evergreen-yonder-dhh073-project is an npm package designed for developers to facilitate specific functionalities within their applications. It is widely used in the JavaScript ecosystem for its ease of integration and utility. However, this package has been identified to contain malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the evergreen-yonder-dhh073-project package. This code can lead to unauthorized access, data breaches, or other harmful actions within the applications that depend on this package. The malicious code was introduced in version 0 and has not been addressed in subsequent releases, making it imperative for users to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall evergreen-yonder-dhh073-projectIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can replace the functionality provided by evergreen-yonder-dhh073-project with alternative packages that do not have known vulnerabilities. Ensure to review the alternatives thoroughly before implementation.
Conclusion
The evergreen-yonder-dhh073-project package has been identified as containing malicious code, posing a serious threat to applications that utilize it. Immediate action is required to uninstall the package and seek alternatives to safeguard your application. Stay vigilant and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for evergreen-yonder-dhh073-project →
FAQ
The malicious code can perform unauthorized actions within your application, potentially leading to data breaches or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Currently, there is no patched version available for the evergreen-yonder-dhh073-project package. It is recommended to uninstall the package until a secure version is released.
If immediate removal is not possible, consider implementing strict access controls and monitoring to mitigate risks until you can safely remove the package.
Utilize tools like Vulert to monitor your package-lock.json for vulnerabilities and receive real-time alerts.
