Malicious Code Vulnerability in Fasterhttp Package
Summary
MAL-2025-6417: Malicious code in fasterhttp (npm). Affects fasterhttp versions 1.0.0 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fasterhttp is an npm package designed for high-performance HTTP requests in Node.js applications. It offers features such as streamlined request handling and improved speed compared to traditional HTTP libraries. However, certain versions of Fasterhttp have been found to contain malicious code, posing a significant security risk to applications that utilize this package.
Vulnerability Detail
The vulnerability identified as MAL-2025-6417 involves the presence of malicious code within the Fasterhttp package. This code can potentially compromise the integrity of applications using the affected versions (1.0.0, 1.0.1, 1.0.2). The malicious code may lead to unauthorized access, data leakage, or other harmful actions within the application environment. The issue originated from a malicious actor who injected harmful code into the package, which was subsequently published to the npm registry.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fasterhttpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the Fasterhttp package temporarily from your project until a secure version is available. You can do this by running:
npm uninstall fasterhttp
This will prevent any potential exploitation of the vulnerability while you assess your options.
Conclusion
The Fasterhttp package has been identified as having a serious vulnerability due to the presence of malicious code in specific versions. It is essential for developers using this package to update to a secure version promptly and consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for fasterhttp →
FAQ
The affected versions are 1.0.0, 1.0.1, and 1.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Using the affected versions may lead to unauthorized access, data leakage, or other harmful actions within your application.
Yes, you can temporarily uninstall the Fasterhttp package to prevent any exploitation of the vulnerability.
The vulnerability was discovered by ReversingLabs, a security research firm.
