Critical Malicious Code Vulnerability in testsec Package
Summary
MAL-2025-4450: Malicious code in testsec (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The testsec package is a tool used in the npm ecosystem for security testing and validation of various applications. It provides developers with functionalities to identify vulnerabilities and ensure that their code adheres to security best practices. However, the package has been compromised, leading to severe security risks for any system that has it installed.
Vulnerability Detail
The vulnerability identified as MAL-2025-4450 originates from the ghsa-malware source, indicating that the testsec package contains malicious code. Any system running this package is considered fully compromised, with the potential for unauthorized access to sensitive information such as secrets and keys. The malicious code can lead to a complete takeover of the affected system, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall testsecIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that all secrets and keys stored on the compromised system are rotated immediately from a different, secure computer. This step is essential to mitigate any potential damage caused by the malicious code.
Conclusion
The testsec package has been compromised with malicious code, posing a significant risk to any system that has it installed. Immediate action is required to remove the package and secure sensitive information. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for testsec →
FAQ
The testsec package is an npm tool designed for security testing and validation of applications, helping developers identify vulnerabilities.
The malicious code can lead to unauthorized access to sensitive information and potentially allow an attacker to take full control of your system.
You should immediately remove the testsec package and rotate any sensitive information stored on the affected system.
Currently, there is no patch available. The recommended action is to remove the package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
