Critical Malicious Code Vulnerability in zigbee2mqtt.io Package
Summary
MAL-2025-5741: Malicious code in zigbee2mqtt.io (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zigbee2mqtt.io package is an npm library that facilitates communication between Zigbee devices and MQTT, allowing users to control and monitor their smart home devices. It is widely used for its ease of integration and support for various Zigbee devices. However, this package has been found to contain malicious code that compromises the security of systems using it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the zigbee2mqtt.io package. This code can lead to full system compromise, allowing attackers to gain unauthorized access to sensitive information, including secrets and keys stored on the affected computer. The malicious nature of this code poses significant risks, as it can persist even after the package is removed, potentially leaving systems vulnerable to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall zigbee2mqtt.ioIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should consider isolating the affected system from the network until the package is removed and the system is verified to be secure. Additionally, running a full security audit and malware scan on the affected system is recommended to identify any lingering threats.
Conclusion
The discovery of malicious code within the zigbee2mqtt.io package poses a serious threat to users and their systems. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to stay vigilant and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for zigbee2mqtt.io →
FAQ
The zigbee2mqtt.io package is an npm library that allows users to connect and control Zigbee devices through MQTT, enabling smart home automation.
The malicious code can compromise your system, allowing attackers to access sensitive information and potentially control your device remotely.
Immediately remove the zigbee2mqtt.io package and rotate any sensitive information stored on the affected system.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not necessarily. While removing the package is crucial, there may be residual malicious software that requires further investigation and remediation.
