Malicious Code Detected in lscommons Package - Version 9.2.0
Summary
MAL-2025-6207: Malicious code in lscommons (npm). Affects lscommons versions 9.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lscommons package is a library in the npm ecosystem designed for various utility functions. It is commonly used in JavaScript applications to streamline development processes. However, version 9.2.0 has been flagged for containing malicious code that poses a security risk to users and their applications.
Vulnerability Detail
The vulnerability in the lscommons package arises from its communication with a domain associated with malicious activity. This behavior can lead to data breaches, unauthorized access, and potential exploitation of the affected systems. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which monitors open-source packages for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lscommonsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the lscommons package from your project until a secure version is available. You can do this by executing: npm uninstall lscommons.
Conclusion
The lscommons package version 9.2.0 has been identified as malicious due to its communication with a harmful domain. Users are advised to update to the latest version or remove the package to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for lscommons →
FAQ
lscommons is a utility library in the npm ecosystem that provides various functions to aid JavaScript development.
Version 9.2.0 has been flagged for communicating with a domain linked to malicious activities, posing a security risk.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, consider uninstalling the lscommons package until a secure version is released.
Vulert uses the package-lock.json file to monitor and alert users in real-time for open-source vulnerabilities, ensuring your software remains secure.
