Critical Malicious Code Vulnerability in proc-log-cmd Package
Summary
MAL-2025-6369: Malicious code in proc-log-cmd (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The proc-log-cmd package is an npm library designed for logging command outputs in a structured manner. It is often utilized in Node.js applications to facilitate better debugging and monitoring. However, this package has been identified to contain malicious code that compromises the security of any system where it is installed, making it a significant risk for developers and organizations relying on it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the proc-log-cmd package. This code can lead to full system compromise, allowing unauthorized access to sensitive information such as secrets and keys stored on the affected machine. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users should be aware that simply removing the package may not eliminate all traces of the malicious software, as it could have already established control over the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall proc-log-cmdIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks associated with the proc-log-cmd package. The best course of action is to uninstall the package and monitor your system for any signs of compromise.
Conclusion
The proc-log-cmd package has been identified as containing malicious code that poses a significant risk to any system where it is installed. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for proc-log-cmd →
FAQ
Immediately uninstall the proc-log-cmd package and rotate any sensitive information stored on your system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
No, it is highly recommended to stop using proc-log-cmd immediately due to the severe security risks it poses.
Failure to address this vulnerability could lead to unauthorized access to your system, data breaches, and loss of sensitive information.
While many npm packages are safe, it is essential to regularly monitor and audit your dependencies for vulnerabilities to ensure the security of your applications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
