Malicious Code Detected in jenkins-trigger-action Package - MAL-2025-6937
Summary
MAL-2025-6937: Malicious code in jenkins-trigger-action (npm). Affects jenkins-trigger-action versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jenkins-trigger-action package is an npm module designed to facilitate the triggering of Jenkins jobs through GitHub Actions. It allows developers to automate their CI/CD pipelines seamlessly. However, this package has been flagged for containing malicious code that communicates with a domain associated with harmful activities, posing significant security risks to users.
Vulnerability Detail
The vulnerability stems from the jenkins-trigger-action package version 10.0.1, which has been identified as malicious by the OpenSSF Package Analysis project. The package executes commands linked to malicious behavior, potentially compromising the security of applications that utilize it. Users may unknowingly expose sensitive data or allow unauthorized access to their systems due to this malicious activity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jenkins-trigger-actionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the jenkins-trigger-action package from your project until a secure version is released. You can do this by executing the following command: npm uninstall jenkins-trigger-action.
Conclusion
The jenkins-trigger-action package has been identified as malicious, posing significant security risks to users. It is essential to update or remove the package to safeguard your applications. Utilizing tools like Vulert can help monitor and alert you to such vulnerabilities in real-time.
See every vulnerability recorded for jenkins-trigger-action →
FAQ
The jenkins-trigger-action package is an npm module that allows developers to trigger Jenkins jobs from GitHub Actions, facilitating CI/CD automation.
The package has been flagged for executing commands associated with malicious behavior and communicating with a domain linked to harmful activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not feasible, consider removing the package from your project as a temporary workaround until a secure version is available.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis report, which provides insights into the malicious activities associated with the package.
