Malicious Code Detected in model-providers Package - Vulnerability MAL-2025-6105
Summary
MAL-2025-6105: Malicious code in model-providers (npm). Affects model-providers versions >= 55.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The model-providers package is an npm library designed to facilitate the integration of various machine learning model providers into applications. It allows developers to easily access and utilize models from different sources, streamlining the process of deploying AI functionalities. However, this package has been identified to communicate with a domain associated with malicious activities, raising significant security concerns for users relying on it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6105 originates from version 55.3.1 of the model-providers package. It involves the package's communication with a domain linked to malicious activities, potentially exposing users to security threats such as data breaches, unauthorized access, or exploitation of sensitive information. This vulnerability poses a risk to any application utilizing this package, as it can compromise the integrity and confidentiality of the data processed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall model-providersIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the model-providers package from your project until a secure version is available. You can do this by executing: npm uninstall model-providers. Alternatively, if you need to maintain functionality, review the package's dependencies and consider using a different library that does not have known vulnerabilities.
Conclusion
The model-providers package has been flagged for a serious vulnerability that could expose users to security threats. It is crucial for developers using this package to update to a patched version or consider alternative solutions to safeguard their applications. Regular monitoring of dependencies is essential to maintain security.
See every vulnerability recorded for model-providers →
FAQ
The model-providers package is an npm library that allows developers to integrate various machine learning models into their applications seamlessly.
This vulnerability involves the model-providers package communicating with a domain associated with malicious activities, posing security risks to users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider removing the model-providers package or using an alternative library until a secure version is released.
Utilize tools like Vulert, which can monitor your package-lock.json file for vulnerabilities and provide real-time alerts.
