Critical Malicious Code Vulnerability in finacle Package
Summary
MAL-2025-20563: Malicious code in finacle (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The finacle package is a widely used npm library that provides various functionalities for financial applications. It is designed to facilitate seamless integration and enhance the performance of financial services. However, the package has been found to contain malicious code, posing significant security risks to applications that depend on it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the finacle package. This code can compromise the security of applications by allowing unauthorized access, data exfiltration, or other malicious activities. The presence of this vulnerability can lead to severe ramifications, including data breaches and loss of user trust.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall finacleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the finacle package from your project until a secure version is available. You can do this by executing: 'npm uninstall finacle'. This will prevent any potential exploitation of the malicious code.
Conclusion
The finacle package has been identified to contain malicious code, posing a significant security risk. It is crucial for developers to update to the latest version or remove the package to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for finacle →
FAQ
The finacle package is an npm library used for financial applications, providing various functionalities to enhance performance and integration.
The malicious code can compromise application security, allowing unauthorized access and potentially leading to data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating the finacle package to the latest version will help mitigate the vulnerability.
If you cannot update the package right away, consider uninstalling it as a temporary measure to protect your application.
