Critical Malicious Code Vulnerability in querypilot Package
Summary
MAL-2025-5951: Malicious code in querypilot (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The querypilot package is an npm library designed for querying and managing data efficiently within JavaScript applications. It offers various functionalities that enhance data manipulation and retrieval processes. However, it has been found to contain embedded malicious code, posing significant security risks to any system utilizing this package.
Vulnerability Detail
The vulnerability stems from the presence of malicious code embedded within the querypilot package. This code can compromise the integrity of any system where the package is installed, potentially allowing unauthorized access to sensitive data, secrets, and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Systems running this package should be considered fully compromised, necessitating immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall querypilotIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to avoid using the querypilot package altogether until a secure version is released. If you must use it, consider isolating it in a controlled environment and monitor its behavior closely.
Conclusion
The querypilot package has been identified as containing malicious code that poses serious security risks. Immediate action is required to remove the package and secure any affected systems. Users are encouraged to stay informed about updates and potential patches.
See every vulnerability recorded for querypilot →
FAQ
The primary risk is that any system running the querypilot package may be fully compromised, leading to unauthorized access to sensitive information.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Immediately remove the querypilot package from your project and rotate any secrets or keys stored on the affected system.
The best mitigation strategy is to avoid using the querypilot package until a secure version is released. If necessary, run it in a controlled environment.
Detailed information about the vulnerability can be found in the GitHub repository linked in the vulnerability report.
