Critical Vulnerability in ninjaonsteroids: Malicious Code Injection
Summary
MAL-2025-6640: Malicious code in ninjaonsteroids (npm). Affects ninjaonsteroids versions 1.0.1 – 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ninjaonsteroids' package is an npm library designed for enhancing JavaScript applications with various functionalities. It is widely used in the development community for its ease of integration and robust features. However, recent findings have revealed that this package contains malicious code that could compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within versions 1.0.1 to 1.0.32 of the 'ninjaonsteroids' package. This code can execute harmful actions, potentially leading to data breaches or unauthorized access to sensitive information. The issue was identified by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ninjaonsteroidsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package temporarily from your project until a secure version is available. You can do this by executing: 'npm uninstall ninjaonsteroids'. This will help mitigate the risk while you assess alternative packages or wait for a patch.
Conclusion
The discovery of malicious code in the 'ninjaonsteroids' package underscores the importance of vigilance when using third-party libraries. By updating to a secure version or temporarily removing the package, developers can protect their applications from potential threats.
See every vulnerability recorded for ninjaonsteroids →
FAQ
The vulnerability involves malicious code that can execute harmful actions within applications using the package.
You can use Vulert, which monitors vulnerabilities in open-source packages. By analyzing your package-lock.json file, it can alert you to any issues. Visit Vulert Scanner to check your application without signing up.
Versions 1.0.1 to 1.0.32 of the ninjaonsteroids package are known to contain the malicious code.
Yes, updating to version 1.0.0 or any version above 1.0.32 will resolve the vulnerability.
Consider uninstalling the package temporarily to mitigate risks until a secure version is available.
