Malicious Code Detected in Gmailtask Package - MAL-2025-21608
Summary
MAL-2025-21608: Malicious code in gmailtask (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'gmailtask' package is an npm module designed for managing tasks related to Gmail. It offers functionalities that allow developers to automate email-related tasks, enhancing productivity. However, this package has been identified to contain malicious code, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the 'gmailtask' package originates from the inclusion of malicious code that can compromise user data and system integrity. This code can lead to unauthorized access, data theft, and potential exploitation of the host system. Users of this package are at risk of severe ramifications, including loss of sensitive information and disruption of services.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall gmailtaskIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'gmailtask' package and look for alternative packages that provide similar functionalities without the associated risks.
Conclusion
The 'gmailtask' package has been identified as containing malicious code, posing significant risks to users. It is crucial to remove this package from your projects and monitor for any updates or alternative solutions. Utilizing tools like Vulert can help keep your applications secure by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for gmailtask →
FAQ
The 'gmailtask' package is an npm module that helps automate tasks related to Gmail, enhancing productivity for developers.
The malicious code found in the 'gmailtask' package can lead to unauthorized access and data theft.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you have used 'gmailtask', you should remove it from your project immediately and look for alternative solutions.
Currently, there is no patched version available. Users are advised to remove the package until further notice.
