Malicious Code Detected in gjs-development-scripts: A Critical Security Alert
Summary
MAL-2025-21500: Malicious code in gjs-development-scripts (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gjs-development-scripts package is designed to assist developers in managing and automating tasks related to GJS (GNOME JavaScript). It provides a set of scripts that streamline the development process. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the gjs-development-scripts package stems from the inclusion of malicious code that can compromise the integrity of the systems using it. This code may lead to unauthorized access, data breaches, or other harmful actions. The issue was identified in all versions starting from 0, making it critical for users to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall gjs-development-scriptsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the gjs-development-scripts package from their project until a secure version is released. This can be done using the command: npm uninstall gjs-development-scripts. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the gjs-development-scripts package highlights the importance of vigilance in software development. Users are urged to take immediate action by updating or removing the affected package to safeguard their applications from potential threats.
See every vulnerability recorded for gjs-development-scripts →
FAQ
gjs-development-scripts is a package that helps developers automate tasks related to GJS, enhancing the development workflow.
The malicious code was identified through security audits and reports from security researchers, including Amazon Inspector.
Using the compromised package can lead to unauthorized access, data loss, or other security breaches in your application.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities at the Vulert playground without any signup.
If you have already used the gjs-development-scripts package, it is crucial to uninstall it immediately and monitor your application for any unusual activity.
