Malicious Code Detected in Microsoft Bonsai API Package - Version 9.9.9
Summary
MAL-2025-6826: Malicious code in microsoft-bonsai-api (npm). Affects microsoft-bonsai-api versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'microsoft-bonsai-api' is an npm package designed to facilitate interactions with Microsoft's Bonsai AI platform. It provides developers with tools to integrate AI capabilities into their applications. However, version 9.9.9 of this package has been flagged for malicious behavior, which poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the 'microsoft-bonsai-api' package stems from its communication with a domain linked to malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the affected systems. The package was identified as malicious by the OpenSSF Package Analysis project, which highlights the importance of scrutinizing third-party dependencies for security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall microsoft-bonsai-apiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'microsoft-bonsai-api' package from your project until a secure version is available. Use the following command to uninstall it: npm uninstall microsoft-bonsai-api.
Conclusion
The 'microsoft-bonsai-api' package version 9.9.9 has been identified as malicious due to its communication with harmful domains. Users are advised to update to a secure version or remove the package until a fix is available. Continuous monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for microsoft-bonsai-api →
FAQ
It is an npm package that allows developers to integrate Microsoft's Bonsai AI capabilities into their applications.
Version 9.9.9 communicates with a domain associated with malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
As a workaround, consider uninstalling the package until a secure version is released.
Utilize tools like Vulert to monitor your package-lock.json for vulnerabilities without needing to access the code or install additional software.
