Critical Malicious Code Vulnerability in postcss-optimizer Package
Summary
MAL-2025-4014: Malicious code in postcss-optimizer (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postcss-optimizer package is a tool used in the Node.js ecosystem for optimizing CSS files. It enhances performance by reducing file sizes and improving load times. However, this package has been compromised, leading to a serious security vulnerability that can affect any system using it.
Vulnerability Detail
The vulnerability identified as MAL-2025-4014 involves malicious code embedded within the postcss-optimizer package. Originating from a compromised source, this malware can fully compromise any computer that has the package installed. The ramifications include unauthorized access to sensitive information, such as secrets and keys, which should be rotated immediately. The malicious code poses a significant threat as it may persist even after the package is removed, indicating a severe risk to system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall postcss-optimizerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to uninstall the postcss-optimizer package using the command: npm uninstall postcss-optimizer. This action will help mitigate the risk of exploitation until a secure version is released.
Conclusion
The postcss-optimizer package has been compromised, leading to a critical vulnerability that can fully compromise systems using it. Immediate action is required to uninstall the package and secure sensitive information. Regular monitoring using tools like Vulert can help prevent future vulnerabilities.
See every vulnerability recorded for postcss-optimizer →
FAQ
postcss-optimizer is a Node.js package designed to optimize CSS files for better performance.
If postcss-optimizer is installed, your system may be fully compromised, allowing unauthorized access to sensitive data.
Immediately uninstall the postcss-optimizer package and rotate any sensitive secrets or keys stored on the affected system.
Yes, you can use Vulert to monitor and alert for vulnerabilities in your application by analyzing your package-lock.json file.
Visit the Vulert playground at Vulert Scanner, where you can check if your application is affected by this vulnerability without needing to sign up.
