Critical Malicious Code Vulnerability in Symphony-Cryptolib (npm)
Summary
MAL-2025-5864: Malicious code in symphony-cryptolib (npm). Affects symphony-cryptolib versions 99.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symphony-Cryptolib is a JavaScript library designed for cryptographic operations, commonly used in Node.js applications. It provides various cryptographic functionalities, including encryption and decryption, to enhance data security. However, this package has been identified to contain malicious code that compromises the integrity and security of systems using it.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the Symphony-Cryptolib package. This code can lead to complete system compromise, allowing unauthorized access to sensitive information such as secrets and keys stored on the affected computer. The malicious nature of this code poses significant risks, as it can potentially allow attackers to control the system remotely and execute harmful actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall symphony-cryptolibIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the use of the compromised package by removing it from your dependencies. Use the following command to uninstall it: npm uninstall symphony-cryptolib. However, be aware that this may not eliminate all malicious software that could have been installed as a result of using this package.
Conclusion
The discovery of malicious code within the Symphony-Cryptolib package poses a significant threat to users and their systems. Immediate action is required to remove the package and secure any sensitive information. Monitoring for updates and utilizing tools like Vulert can help in managing such vulnerabilities effectively.
See every vulnerability recorded for symphony-cryptolib →
FAQ
The malicious code embedded in Symphony-Cryptolib can lead to unauthorized access and control over the affected system, posing serious security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If you have installed Symphony-Cryptolib, you should immediately uninstall it and rotate any sensitive information stored on the affected system.
Currently, there is no patched version available. The best course of action is to uninstall the package and monitor for updates from the maintainers.
Failure to address this vulnerability can result in complete system compromise, unauthorized access to sensitive data, and potential exploitation by attackers.
