Malicious Code Detected in Playwright E2E Testing Package - MAL-2025-5818
Summary
MAL-2025-5818: Malicious code in playwright-e2e-testing (npm). Affects playwright-e2e-testing versions >= 10.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'playwright-e2e-testing' package is a tool designed for end-to-end testing of web applications using the Playwright framework. It facilitates automated browser testing, allowing developers to simulate user interactions and validate application functionality. However, this package has been identified to communicate with a domain associated with malicious activities, raising significant security concerns for users relying on it for testing purposes.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful scripts within the user's environment. The issue was introduced in version 10.0.0 and poses a serious risk to any application utilizing this package, as it may compromise the integrity and security of the testing environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall playwright-e2e-testingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the 'playwright-e2e-testing' package from your project until a secure version is released. You can do this by executing: 'npm uninstall playwright-e2e-testing'. Additionally, monitor your application for any suspicious activity.
Conclusion
The 'playwright-e2e-testing' package has a critical vulnerability that allows communication with a malicious domain, posing significant security risks. Users are advised to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for playwright-e2e-testing →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not feasible, consider removing the package temporarily and monitoring your application for any unusual behavior.
Yes, there is a potential risk of data breaches or unauthorized access, which could lead to data loss or corruption.
Detailed information can be found in the vulnerability report on GitHub: https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/playwright-e2e-testing/MAL-2025-5818.json.
