Malicious Code Detected in gacrux-iota-exec-shelljs: A Critical Security Alert
Summary
MAL-2025-21108: Malicious code in gacrux-iota-exec-shelljs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package gacrux-iota-exec-shelljs is an npm package designed to facilitate the execution of shell commands within JavaScript applications. It is commonly used for automating tasks and enhancing the functionality of Node.js applications. However, this package has been identified as containing malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in gacrux-iota-exec-shelljs arises from the inclusion of malicious code that can compromise the integrity of applications utilizing this package. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious nature of this code was discovered by Amazon Inspector, highlighting the importance of scrutinizing third-party packages for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall gacrux-iota-exec-shelljsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider replacing gacrux-iota-exec-shelljs with an alternative package that provides similar functionality without the associated risks. Additionally, you can monitor your project for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file for real-time alerts on open-source vulnerabilities.
Conclusion
The discovery of malicious code in gacrux-iota-exec-shelljs underscores the importance of vigilance when using third-party packages. Users are encouraged to update or replace the affected package to safeguard their applications from potential threats.
See every vulnerability recorded for gacrux-iota-exec-shelljs →
FAQ
gacrux-iota-exec-shelljs is an npm package used for executing shell commands in JavaScript applications.
The malicious code was identified by Amazon Inspector, a security tool that scans for vulnerabilities in software packages.
Using the affected package can lead to unauthorized access, data breaches, and potential harm to your applications and systems.
You can use Vulert's playground to analyze your package-lock.json file for vulnerabilities without needing to sign up.
If immediate updates are not possible, consider using a workaround by replacing the package with a safer alternative.
