Malicious Code Detected in groq-link2: A Security Threat to npm Users
Summary
MAL-2025-6093: Malicious code in groq-link2 (npm). Affects groq-link2 versions >= 1.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'groq-link2' package is an npm library designed for linking and managing Groq queries in JavaScript applications. It is utilized by developers to streamline query management, enhancing productivity and code organization. However, recent findings have revealed that certain versions of this package contain malicious code that communicates with domains associated with harmful activities, posing a significant security risk to users.
Vulnerability Detail
The vulnerability in the 'groq-link2' package originates from its versions 1.0.23 and 1.0.25, which have been identified as malicious by the OpenSSF Package Analysis project. The package is known to communicate with domains linked to malicious activities and executes commands that may compromise user systems. This vulnerability can lead to unauthorized access, data breaches, and potential exploitation of the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall groq-link2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the 'groq-link2' package from their projects until a safe version is confirmed. This can be done by executing: npm uninstall groq-link2. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the 'groq-link2' package highlights the importance of vigilance in managing dependencies in software projects. Users are strongly advised to update to the latest version or remove the package to mitigate potential security risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for groq-link2 →
FAQ
Versions 1.0.23 and 1.0.25 of the groq-link2 package are identified as malicious.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
If an immediate update is not possible, consider removing the package from your project as a temporary measure until a safe version is available.
Using the affected versions can lead to unauthorized access, data breaches, and exploitation of your system due to the malicious behavior embedded in the package.
Yes, using tools like Vulert can help you monitor and receive alerts for open-source vulnerabilities in real-time without needing to access the code or install additional software.
