Malicious Code Detected in jquery-tools Package - Security Alert
Summary
MAL-2025-6288: Malicious code in jquery-tools (npm). Affects jquery-tools versions >= 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jquery-tools package is a popular JavaScript library that provides a collection of user interface components and utilities for web development. It is widely used for enhancing user experience through various interactive elements. However, this package has been identified as having a vulnerability that allows it to communicate with a domain associated with malicious activity, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability in the jquery-tools package originates from version 99.99.1 and later, where the package is found to communicate with a malicious domain. This behavior can lead to unauthorized data access, data exfiltration, and other security risks for applications utilizing this package. The malicious activity associated with this domain poses a significant threat to both developers and end-users, making it crucial to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jquery-toolsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the jquery-tools package from your project if it is not essential. This can be done using the command: npm uninstall jquery-tools. Alternatively, consider using a different library that provides similar functionality without the associated risks.
Conclusion
The jquery-tools package has been identified with a serious vulnerability that allows communication with a malicious domain. It is essential to update the package or implement workarounds to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for jquery-tools →
FAQ
jquery-tools is a JavaScript library that offers various UI components and utilities for web development, enhancing user interactions.
The vulnerability allows the package to communicate with a malicious domain, which can lead to unauthorized access to sensitive data and compromise application security.
If an immediate update is not possible, consider removing the package or using an alternative library until a secure version is available.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
