Critical Malicious Code Vulnerability in jsr305 Package
Summary
MAL-2025-6101: Malicious code in jsr305 (npm). Affects jsr305 versions >= 3.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsr305 package is a JavaScript library commonly used in Node.js applications for providing annotations that assist in static analysis. It is designed to improve code quality and maintainability by offering a set of annotations that can be used to indicate nullability and other properties. However, this package has been found to communicate with a domain associated with malicious activity, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the jsr305 package originates from its version 3.0.0 and later, where it has been identified to communicate with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or other security incidents, as the package may inadvertently expose sensitive information or allow for remote code execution. The malicious behavior compromises the integrity of applications relying on this package, making it critical for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jsr305If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the jsr305 package from your project if it is not essential. Alternatively, you can replace it with a similar package that does not exhibit malicious behavior. Always ensure to review the dependencies of any new package you choose to implement.
Conclusion
The jsr305 package has a critical vulnerability that allows it to communicate with a malicious domain, posing risks to applications that utilize it. Developers are urged to update the package to a patched version or consider alternative solutions to mitigate potential threats.
See every vulnerability recorded for jsr305 →
FAQ
The jsr305 package is a JavaScript library that provides annotations for static analysis, helping developers improve code quality and maintainability.
The vulnerability involves the jsr305 package communicating with a domain associated with malicious activities, which can compromise application security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider removing the jsr305 package or replacing it with a safer alternative until you can apply the necessary updates.
Vulert uses just package-lock.json to monitor and alert in real-time for open-source vulnerabilities, providing developers with insights into potential risks.
