Malicious package in the dependencies
Scan rule · RSC-SEC-150
- Security
- Severity: Critical
- CWE-506
- OWASP A08-2021
Matches the repository's package versions against the OpenSSF database of known malicious packages (via OSV, `MAL-` entries and advisories flagged as malware) and detects packages npm has replaced with a security placeholder.
Why this matters
A malicious package is not a hole waiting for an attacker — it is the attack. The Shai-Hulud wave in autumn 2025 showed it: compromised releases of well-known npm packages shipped an install script that ran on `npm install`, collected npm and GitHub tokens and used them to copy itself into further packages. Anyone who installed such a version has to assume that the credentials of the machine and the CI are gone.
Ordinary vulnerability checks often misfile these entries: malware records usually carry no CVSS score and end up as “medium” between outdated libraries. We separate them and report them as what they are.
Check it yourself: the `MAL-` identifier leads to the description and affected versions on osv.dev; `npm ls <package>` shows whether and through which path the package is installed. After removal, rotating the tokens matters more than the update — the install scripts may have run.
Scan tier
- Repo access (deep scan)
How to fix it
Remove the package, regenerate the lock file, clear node_modules and CI caches, then rotate every npm, GitHub, CI and cloud token that was available there.