Critical Malicious Code Vulnerability in js-prettier Package
Summary
MAL-2025-5926: Malicious code in js-prettier (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
js-prettier is an npm package designed to format JavaScript code according to specified style guidelines. It is widely used in the JavaScript community for maintaining code quality and consistency. However, a recent vulnerability has been identified that allows malicious code to be embedded within the package, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the js-prettier package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. Users are advised to treat any system running this package as fully compromised, as the malicious code could lead to further exploitation and data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall js-prettierIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should refrain from using the js-prettier package until the vulnerability is addressed. It is advisable to explore alternative formatting tools that do not have known security issues.
Conclusion
The js-prettier package has been found to contain embedded malicious code, posing a significant security threat to users. Immediate action is required to remove the package and secure sensitive information. Users are encouraged to monitor for updates and consider alternative tools until a fix is available.
See every vulnerability recorded for js-prettier →
FAQ
js-prettier is an npm package used for formatting JavaScript code to ensure consistency and adherence to style guidelines.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to further exploitation.
You should immediately remove the js-prettier package and rotate any sensitive information stored on the affected system.
As of now, there is no patched version available. Users should monitor the package for updates and remove it until a fix is released.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your package-lock.json file, you can check for vulnerabilities without requiring access to the code or installation.
