Critical Malicious Code Vulnerability in jsonli-conf Package
Summary
MAL-2025-5927: Malicious code in jsonli-conf (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsonli-conf package is an npm library designed for configuration management in JavaScript applications. It allows developers to manage and manipulate configuration settings easily. However, this package has been identified as containing malicious code that poses significant security risks to systems where it is installed.
Vulnerability Detail
The vulnerability stems from embedded malicious code within the jsonli-conf package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information, including secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users are advised to treat any system running this package as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jsonli-confIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to avoid using the jsonli-conf package altogether until a secure version is released. If you must use it, consider isolating it in a controlled environment where sensitive data is not accessible.
Conclusion
The jsonli-conf package has been identified as containing malicious code that compromises system security. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for jsonli-conf →
FAQ
Immediately remove the jsonli-conf package from your system and rotate any secrets or keys that may have been compromised.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Keeping jsonli-conf installed poses a significant risk of unauthorized access to sensitive information and potential control over your system by malicious actors.
The best mitigation is to remove the package entirely. If removal is not possible, isolate its use in a secure environment.
While removing jsonli-conf is a critical step, there is no guarantee that all malicious software installed as a result of this package will be removed. A thorough security audit is recommended.
