Critical Malicious Code Vulnerability in external-pkg (npm)
Summary
MAL-2025-6722: Malicious code in external-pkg (npm). Affects external-pkg versions >= 16.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'external-pkg' is an npm package designed for various functionalities in JavaScript applications, often used for integrating external services or libraries. However, it has been identified to communicate with a domain associated with malicious activities, raising significant security concerns for users relying on this package.
Vulnerability Detail
The vulnerability stems from the package's communication with a malicious domain, which could lead to data breaches, unauthorized access, or the execution of harmful code within applications using this package. This issue was introduced in version 16.0.0 and poses a risk to any application that integrates 'external-pkg'.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall external-pkgIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the 'external-pkg' from your project until a secure version is released. You can do this by running: 'npm uninstall external-pkg'. Additionally, monitor your application for any suspicious activity.
Conclusion
The 'external-pkg' npm package has a critical vulnerability that allows communication with a malicious domain, posing significant risks to applications. Users are advised to update the package as soon as a patched version is available or to remove it temporarily to safeguard their applications.
See every vulnerability recorded for external-pkg →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which could compromise application security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, consider removing the package and monitoring your application for any unusual behavior as a temporary measure.
While specific exploits have not been detailed, the potential for data breaches and unauthorized access exists due to the package's communication with a malicious domain.
Regularly check the package's repository and utilize tools like Vulert to receive real-time alerts for any new vulnerabilities in your dependencies.
