Malicious Code Detected in third-party-library: A Critical Vulnerability
Summary
MAL-2025-6859: Malicious code in third-party-library (npm). Affects third-party-library versions >= 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The third-party-library is an npm package widely used for various functionalities in JavaScript applications. It provides essential features that enhance development efficiency. However, this package has been identified as having a vulnerability that allows it to communicate with a domain associated with malicious activities, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability arises from the package's ability to connect with a malicious domain, which can lead to data breaches, unauthorized access, and potential exploitation of the application. This issue was introduced in version 99.99.1 and can affect any application that relies on this package, making it critical for developers to address it promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall third-party-libraryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the third-party-library from your project until a secure version is available. This can be done by executing: npm uninstall third-party-library.
Conclusion
The third-party-library has a critical vulnerability that allows communication with a malicious domain, posing serious risks to applications. It is essential to update the package to the latest version or remove it until a fix is applied. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for third-party-library →
FAQ
The vulnerability allows the package to communicate with a domain linked to malicious activities, which can compromise application security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider removing the package from your project as a temporary workaround until a secure version is released.
Yes, a patched version of the third-party-library is available. Make sure to update to the latest version to mitigate the risk.
The vulnerability was identified by Amazon Inspector, a security assessment service.
