Malicious Code Detected in super-alpha-api: A Critical Security Concern
Summary
MAL-2025-5826: Malicious code in super-alpha-api (npm). Affects super-alpha-api versions >= 2.3.79-99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'super-alpha-api' package is an npm library designed for developers to easily integrate various APIs into their applications. It offers functionalities such as API requests, data handling, and response parsing. However, this package has been identified to communicate with a domain linked to malicious activities, raising significant security concerns for users relying on it.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain associated with malicious activity. This could lead to data breaches, unauthorized access, or the execution of harmful scripts within applications using this package. The issue was introduced in version 2.3.79-99, making it critical for users to address it promptly to safeguard their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall super-alpha-apiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the 'super-alpha-api' package from their project until a secure version is available. This can be done by executing 'npm uninstall super-alpha-api' in the terminal.
Conclusion
The discovery of malicious code in the 'super-alpha-api' package underscores the importance of regular updates and monitoring for vulnerabilities in open-source software. Users are urged to update or remove the package to protect their applications from potential threats.
See every vulnerability recorded for super-alpha-api →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, posing a risk to user data and application integrity.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you to any issues. You can also check your application using the Vulert playground without signup.
If immediate updates are not possible, consider removing the package from your project as a temporary measure to mitigate risks.
Users should avoid using versions 2.3.79-99 and check for the latest patched version of the package to ensure safety.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities by analyzing your package-lock.json file, helping you maintain secure applications.
