Malicious Code Detected in git-ocr Package - Security Alert
Summary
MAL-2025-21456: Malicious code in git-ocr (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The git-ocr package is an npm library designed for Optical Character Recognition (OCR) tasks, allowing developers to extract text from images using Git repositories. While it offers useful functionalities for image processing, it has been identified to contain malicious code that poses significant security risks to applications utilizing this package.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the git-ocr package, which was introduced in version 0. This malicious code can potentially compromise the security of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. It is crucial for developers to be aware of this vulnerability to protect their applications and users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall git-ocrIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the git-ocr package altogether and implement alternative OCR solutions that are known to be secure. Consider using libraries such as Tesseract.js or other reputable OCR tools.
Conclusion
The detection of malicious code in the git-ocr package poses a serious threat to applications that utilize it. Developers are urged to take immediate action by removing the package and exploring secure alternatives to safeguard their applications and users.
See every vulnerability recorded for git-ocr →
FAQ
The git-ocr package is an npm library used for Optical Character Recognition (OCR) tasks, allowing developers to extract text from images.
The malicious code can lead to unauthorized access and potential data breaches in applications that utilize the git-ocr package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
It is advised to remove the git-ocr package and replace it with a secure alternative. If a patched version is released, update the package using npm update git-ocr.
Yes, alternatives such as Tesseract.js and other reputable OCR libraries can be used instead of git-ocr for secure text extraction from images.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
