Critical Malicious Code Vulnerability in facet-cli Package
Summary
MAL-2025-20146: Malicious code in facet-cli (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The facet-cli package is a command-line interface tool designed for various functionalities in JavaScript applications, particularly within the npm ecosystem. It is widely used for managing tasks and automating workflows. However, it has been identified to contain malicious code that poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the facet-cli package stems from the inclusion of malicious code that can compromise the integrity of applications utilizing this package. This code may lead to unauthorized access, data breaches, or other harmful actions within the user's environment. The issue was introduced in version 0 and affects all subsequent versions, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall facet-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the facet-cli package until a secure version is released. Alternatively, consider using other CLI tools that offer similar functionalities without the associated risks.
Conclusion
The facet-cli package has been found to contain malicious code that poses serious security risks. Users are urged to update the package as soon as a patched version is available and to consider alternative tools in the meantime. Utilizing services like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for facet-cli →
FAQ
Facet-cli is a command-line interface tool used in JavaScript applications for managing tasks and automating workflows.
The malicious code can lead to unauthorized access and potential data breaches within applications that utilize the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
As a workaround, you can refrain from using the facet-cli package until a secure version is released or switch to alternative CLI tools.
The vulnerability was identified by Amazon Inspector, a security service that helps in finding vulnerabilities in applications.
