Malicious Code Detected in openai-voice-agent-sdk-sample Package
Summary
MAL-2025-6114: Malicious code in openai-voice-agent-sdk-sample (npm). Affects openai-voice-agent-sdk-sample versions >= 55.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openai-voice-agent-sdk-sample package is designed to facilitate the integration of voice capabilities with OpenAI's technology. It allows developers to create applications that can process and respond to voice commands. However, this package has been identified as having a vulnerability that connects it to a domain associated with malicious activities, posing a risk to users and their applications.
Vulnerability Detail
The vulnerability in the openai-voice-agent-sdk-sample package arises from its communication with a domain linked to malicious activities. This connection can lead to unauthorized data access, potential data breaches, and exploitation of the application by malicious actors. The vulnerability was introduced in version 55.3.1, making it critical for users to address this issue promptly to safeguard their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall openai-voice-agent-sdk-sampleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected version of the package (55.3.1) and revert to an earlier version that does not have this vulnerability. You can specify an earlier version in your package.json file, for example: 'openai-voice-agent-sdk-sample': '55.3.0'.
Conclusion
The openai-voice-agent-sdk-sample package has a critical vulnerability that connects it to a malicious domain. Users are urged to update the package to a patched version to mitigate risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for openai-voice-agent-sdk-sample →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, which can compromise application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can revert to an earlier version of the package that does not have this vulnerability.
You should update to the latest stable version of the openai-voice-agent-sdk-sample package that addresses this vulnerability. Check the package repository for details.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and exploitation of your application by malicious actors.
