Critical Malicious Code Vulnerability in rush-plugins Package
Summary
MAL-2025-6955: Malicious code in rush-plugins (npm). Affects rush-plugins versions >= 999.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rush-plugins package is a collection of plugins designed to enhance the functionality of the Rush build orchestration tool used in JavaScript projects. It allows developers to manage and streamline their build processes effectively. However, this package has been identified to communicate with a domain associated with malicious activity, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability arises from the rush-plugins package's communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications that depend on this package. The issue was introduced in version 999.0.0 and has been classified as a critical security concern due to its implications for user data and application integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rush-pluginsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the rush-plugins package from your project until a secure version is released. This can be done using the command: 'npm uninstall rush-plugins'.
Conclusion
The rush-plugins package has a critical vulnerability that allows communication with a malicious domain, posing significant risks to applications. It is crucial to update the package to a secure version or remove it until a fix is available. Utilizing tools like Vulert can help monitor your application for such vulnerabilities effectively.
See every vulnerability recorded for rush-plugins →
FAQ
rush-plugins is a set of plugins that enhance the functionality of the Rush build orchestration tool for JavaScript projects.
The vulnerability involves the rush-plugins package communicating with a domain associated with malicious activities, posing risks to application security.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider uninstalling the rush-plugins package until a secure version is available.
The vulnerability was identified by Amazon Inspector, a security assessment service.
