Malicious Code Detected in merlin-transformer Package - Vulnerability MAL-2025-6940
Summary
MAL-2025-6940: Malicious code in merlin-transformer (npm). Affects merlin-transformer versions >= 13.7.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The merlin-transformer package is an npm library designed to facilitate the transformation of data within applications. It provides various utilities for data manipulation and is widely used in JavaScript projects. However, this package has been identified to communicate with a domain associated with malicious activity, raising significant security concerns for users.
Vulnerability Detail
The vulnerability identified as MAL-2025-6940 originates from the merlin-transformer package version 13.7.9 and later. This issue allows the package to connect to a potentially harmful domain, which could lead to data breaches, unauthorized access, or the execution of malicious code within applications that utilize this package. The ramifications of this vulnerability could be severe, affecting the integrity and security of the software relying on merlin-transformer.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall merlin-transformerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the merlin-transformer package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall merlin-transformer.
Conclusion
The merlin-transformer package has been identified with a serious vulnerability that allows communication with a malicious domain. Users are advised to update the package or remove it until a secure version is available. Regular monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for merlin-transformer →
FAQ
merlin-transformer is an npm library used for data transformation in JavaScript applications.
This vulnerability allows the merlin-transformer package to communicate with a malicious domain, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
As a workaround, you can uninstall the merlin-transformer package until a secure version is available.
Utilizing tools like Vulert can help you monitor your package-lock.json for vulnerabilities and provide alerts in real-time.
