Malicious Code Detected in 'search-result' Package - Version 10.11.0
Summary
MAL-2025-6872: Malicious code in search-result (npm). Affects search-result versions 10.11.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'search-result' package is an npm library designed to facilitate searching and retrieving results from various data sources. It is commonly used in web applications to enhance user experience by providing efficient search functionalities. However, version 10.11.0 of this package has been flagged for containing malicious code that compromises its integrity and security.
Vulnerability Detail
The vulnerability in the 'search-result' package arises from its ability to communicate with a domain linked to malicious activities. Additionally, it executes commands that are associated with harmful behavior, potentially leading to unauthorized access, data breaches, or system compromise. This issue was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to these concerning behaviors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall search-resultIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'search-result' package from your project until a secure version is released. This can be done by executing the following command: npm uninstall search-result. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The 'search-result' package version 10.11.0 has been identified as malicious due to its communication with harmful domains and execution of malicious commands. Users are advised to update to a secure version or remove the package until a fix is available. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for search-result →
FAQ
The 'search-result' package is an npm library used for searching and retrieving results from various data sources in web applications.
Version 10.11.0 is considered malicious because it communicates with a domain linked to harmful activities and executes commands that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not possible, consider removing the package from your project as a temporary measure and look for alternative packages.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis project documentation and the GitHub repository for the 'search-result' package.
