Malicious Code Detected in project-bounty: A Critical npm Vulnerability
Summary
MAL-2025-6949: Malicious code in project-bounty (npm). Affects project-bounty versions >= 1337.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'project-bounty' package is an npm library designed to facilitate project management and bounty tracking within software development. It offers features such as task assignment, progress tracking, and reward distribution for completed tasks. However, this package has been identified to communicate with a domain associated with malicious activity, posing a significant security risk to users.
Vulnerability Detail
The vulnerability arises from the package's communication with a potentially harmful domain, which could lead to data breaches, unauthorized access, or the execution of malicious code within the user's environment. This issue was introduced in version 1337.0.0 and can compromise the integrity and confidentiality of the applications utilizing this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall project-bountyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the 'project-bounty' package from your project until a secure version is released. You can do this by executing: 'npm uninstall project-bounty'. Additionally, monitor your application for any suspicious activity.
Conclusion
The 'project-bounty' package has a critical vulnerability due to its communication with a malicious domain. Users are advised to update the package to the latest version or uninstall it until a secure version is available. Regular monitoring of your application using tools like Vulert can help in identifying such vulnerabilities promptly.
See every vulnerability recorded for project-bounty →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise user data and application security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your package-lock.json file to Vulert's playground at Vulert Scanner to check for vulnerabilities.
Yes, updating to a patched version of the 'project-bounty' package will resolve the vulnerability. Use 'npm update project-bounty' to apply the update.
If an immediate update is not possible, consider uninstalling the package as a temporary measure and monitor your application for any unusual behavior.
The vulnerability was identified by Amazon Inspector, a security service that helps in identifying vulnerabilities in applications.
