Malicious Code Detected in google-fishbones-poc Package - Security Alert
Summary
MAL-2025-6090: Malicious code in google-fishbones-poc (npm). Affects google-fishbones-poc versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The google-fishbones-poc package is an npm library designed for specific functionalities within JavaScript applications. It is commonly used for various development tasks. However, this package has been identified as having a critical security vulnerability that allows it to communicate with a domain associated with malicious activities, potentially compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability in the google-fishbones-poc package originates from its ability to connect to a malicious domain. This can lead to unauthorized data access, data exfiltration, or other harmful actions that could jeopardize the integrity and confidentiality of the application and its users. The issue was introduced in version 1.0.0 and poses significant risks to any application relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall google-fishbones-pocIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the google-fishbones-poc package from your project until a secure version is released. You can uninstall the package using the following command: npm uninstall google-fishbones-poc.
Conclusion
The google-fishbones-poc package has been identified with a serious vulnerability that can lead to malicious activities. It is crucial for developers to update or remove this package to protect their applications. Utilizing tools like Vulert can help monitor and identify such vulnerabilities in real-time.
See every vulnerability recorded for google-fishbones-poc →
FAQ
The google-fishbones-poc package is an npm library used for various development tasks in JavaScript applications.
The package has a vulnerability that allows it to communicate with a domain linked to malicious activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider removing the google-fishbones-poc package from your project until a secure version is available.
You can reach out to Amazon Inspector at actran@amazon.com for further inquiries regarding this vulnerability.
