Malicious Code Detected in inditextech Package - Version 10.0.3
Summary
MAL-2025-6349: Malicious code in inditextech (npm). Affects inditextech versions 1.0.3 – 10.4.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'inditextech' package is an npm library that is utilized for various functionalities in JavaScript applications. It is designed to streamline certain processes within the development environment. However, version 10.0.3 has been flagged for containing malicious code that poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the 'inditextech' package arises from its communication with a domain known for malicious activities. This package executes commands that are associated with harmful behavior, potentially compromising the security of applications that utilize it. The origin of this issue is linked to the package's design, which allows it to perform unauthorized actions, leading to severe ramifications such as data breaches or unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall inditextechIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'inditextech' package from your project until a secure version is released. This can be done by executing the command: 'npm uninstall inditextech'. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The 'inditextech' package version 10.0.3 has been identified as malicious, posing serious security risks to applications that utilize it. Users are advised to update or uninstall the package to safeguard their projects. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for inditextech →
FAQ
The 'inditextech' package is an npm library used in JavaScript applications for various functionalities, but it has been identified as malicious in version 10.0.3.
The vulnerability allows the package to communicate with malicious domains and execute harmful commands, potentially compromising your application's security.
You should immediately update the package to a patched version or uninstall it to protect your application from potential threats.
Yes, you can use Vulert, which monitors and alerts you in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application for this specific vulnerability using the Vulert playground without any signup.
You can check if your application is affected by visiting the Vulert playground at Vulert Scanner, where you can analyze your package-lock.json for vulnerabilities.
