Malicious Code Detected in pro-rhr-container: npm Package Vulnerability
Summary
MAL-2025-6119: Malicious code in pro-rhr-container (npm). Affects pro-rhr-container versions >= 9.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'pro-rhr-container' package is an npm library designed for container management and orchestration. It provides developers with tools to streamline the deployment and management of containerized applications. However, version 9.0.3 of this package has been identified as malicious, executing commands associated with harmful behavior and communicating with domains linked to malicious activities.
Vulnerability Detail
The vulnerability in the 'pro-rhr-container' package originates from version 9.0.3, which has been flagged as malicious by the OpenSSF Package Analysis project. This version executes commands that can lead to unauthorized actions on the user's system, potentially compromising security and data integrity. The package's communication with malicious domains raises significant concerns regarding data exfiltration and system exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pro-rhr-containerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'pro-rhr-container' package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall pro-rhr-container.
Conclusion
The 'pro-rhr-container' package version 9.0.3 has been identified as malicious, executing harmful commands and communicating with malicious domains. It is crucial to update or remove this package to mitigate potential risks. Utilizing tools like Vulert can help monitor your dependencies for vulnerabilities effectively.
See every vulnerability recorded for pro-rhr-container →
FAQ
The vulnerability involves the execution of malicious commands and communication with harmful domains, posing a risk to user systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider removing the package from your project as a temporary measure until a secure version is available.
While specific exploits have not been detailed, the nature of the malicious commands suggests potential for unauthorized access and data compromise.
Regularly check for updates in your package dependencies and utilize tools like Vulert to receive real-time alerts for vulnerabilities.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
