MAL-2025-6026
Malicious code in synckit (npm)
Not rated yet
npm
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
This package installs a windows based malware file node-gyp.dll via install.js
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| synckit | 1 listed versions | No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Other links
Timeline
- Published
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f29h-pxvx-f335 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code | High Known exploited | Also affects synckit |
Credits: GitHax - Software Supply Chain Threat Intelligence
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor