Malicious Code Detected in fusion-dev-cli: A Critical Security Alert
Summary
MAL-2025-21060: Malicious code in fusion-dev-cli (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package fusion-dev-cli is a tool designed for developers to streamline their workflow in building and deploying applications. It offers various functionalities that enhance productivity, such as automated tasks and integration with other development tools. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users who rely on it.
Vulnerability Detail
The vulnerability in fusion-dev-cli originates from the inclusion of malicious code within the package. This code can potentially compromise user systems, leading to unauthorized access, data breaches, or other malicious activities. The issue affects all versions starting from the initial release, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fusion-dev-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using fusion-dev-cli until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The discovery of malicious code in the fusion-dev-cli package highlights the importance of vigilance when using open-source software. Users are urged to take immediate action to protect their systems by uninstalling the affected package and updating to a secure version. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for fusion-dev-cli →
FAQ
fusion-dev-cli is a development tool that helps streamline workflows for building and deploying applications.
The malicious code can lead to unauthorized access and potential data breaches, compromising user security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed fusion-dev-cli, you should uninstall it immediately and update to the latest version using 'npm install fusion-dev-cli@latest'.
Yes, consider using other development tools that offer similar functionalities without the security risks associated with fusion-dev-cli.
