Malicious Code Detected in windap-web Package: Version 9.2.99
Summary
MAL-2025-47424: Malicious code in windap-web (npm). Affects windap-web versions 9.2.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'windap-web' package is an npm library used for interacting with Windows Active Directory. It provides functionalities for querying and managing directory services. However, version 9.2.99 has been flagged for malicious behavior, indicating a serious security risk for applications relying on this package.
Vulnerability Detail
The vulnerability in the 'windap-web' package arises from its communication with a domain linked to malicious activities. This behavior can lead to unauthorized data access, data exfiltration, or compromise of the host system. The issue was identified by the OpenSSF Package Analysis project, which flagged version 9.2.99 as malicious due to its potential to harm users and systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall windap-webIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the 'windap-web' package from your project until a secure version is released. You can do this by running the command: 'npm uninstall windap-web'. This will prevent any malicious activity associated with the current version.
Conclusion
The 'windap-web' package version 9.2.99 has been identified as malicious, posing significant security risks. It is crucial for developers to update or remove this package to protect their applications from potential threats. Regular monitoring of dependencies using tools like Vulert can help maintain security.
See every vulnerability recorded for windap-web →
FAQ
The 'windap-web' package is used for interacting with Windows Active Directory, allowing developers to query and manage directory services.
A package is flagged as malicious when it exhibits behavior that can harm users or systems, such as communicating with known malicious domains.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider removing the package as a temporary measure to mitigate risks until a secure version is available.
Utilize tools like Vulert to monitor your project's dependencies for vulnerabilities in real-time, ensuring you are alerted to any issues as they arise.
