Critical Malicious Code Vulnerability in query-logger Package
Summary
MAL-2025-6339: Malicious code in query-logger (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The query-logger package is an npm module designed to log and manage queries in applications. It is commonly used in web development to track database interactions and improve debugging processes. However, this package has been compromised, embedding malicious code that poses significant security risks to systems using it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the query-logger package. This code can lead to full system compromise, allowing attackers to gain unauthorized access to sensitive data, including secrets and keys stored on the affected machine. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users who have installed this package should consider their systems fully compromised, as the removal of the package may not eliminate all traces of the malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall query-loggerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the query-logger package altogether and look for alternative logging solutions that do not have known vulnerabilities. Additionally, ensure that your application is monitored for any unusual activities that may arise from the use of this package.
Conclusion
The query-logger package has been identified as containing malicious code that can compromise systems. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor their applications and consider using alternative logging solutions.
See every vulnerability recorded for query-logger →
FAQ
Immediately remove the package from your project and consider your system compromised. Rotate any secrets or keys stored on that machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and complete control of your system by malicious actors.
The best mitigation is to remove the package entirely and replace it with a secure alternative. Regularly monitor your application for any suspicious activities.
You can find detailed information about this vulnerability on the GitHub repository of the malicious packages or through security advisories related to the query-logger package.
