Critical Malicious Code Vulnerability in telenet (npm) - Communicates with Malicious Domain
Summary
MAL-2025-6131: Malicious code in telenet (npm). Affects telenet versions >= 10.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The telenet package is an npm library designed to facilitate network communication and management. It is widely used in various applications for its ease of use and robust features. However, this package has been identified to contain malicious code that communicates with a domain associated with harmful activities, posing a significant risk to users and their applications.
Vulnerability Detail
The vulnerability in the telenet package originates from version 10.0.0 and later, where it has been found to establish connections with a domain linked to malicious activities. This can lead to data breaches, unauthorized access, and potential exploitation of the affected systems. Users of this package are at risk of having their applications compromised, which could result in severe consequences including data loss and reputational damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall telenetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the telenet package from your project until a secure version is released. You can do this by executing the command: 'npm uninstall telenet'. This will prevent any malicious activity associated with the package while you seek alternatives.
Conclusion
The telenet package has a critical vulnerability that allows it to communicate with a malicious domain, posing significant risks to users. It is essential to update to a secure version or remove the package to protect your applications from potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for telenet →
FAQ
The telenet package is used for network communication and management in various applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Using the vulnerable version can lead to data breaches, unauthorized access, and exploitation of your application.
Yes, updating to a version of telenet that does not contain the malicious code will resolve the vulnerability.
Consider uninstalling the package temporarily and look for alternative solutions until a secure version is available.
