Embedded Malicious Code Affecting got-fetch package, versions >5.1.10 <6.0.0
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-GOTFETCH-10873306
- published22 Jul 2025
- disclosed19 Jul 2025
- creditAriel Harush, Tal Folkman
Introduced: 19 Jul 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade got-fetch to version 6.0.0 or higher.
Overview
got-fetch is a malicious package. through an npm postinstall script 'install.js'. A malicious actor compromised the credentials of one of the maintainers via a phishing attack; This allowed the attacker to publish tampered versions of the package to npm.
Script Behavior
The script attempts to execute a malicious payload in 'crashreporter.dll', which is included in the package, using rundll32 on Windows systems.
Notes:
- While only versions 5.1.11 and 5.1.12 are affected, the maintainer has chosen to deprecate all versions on NPM with the suggestion to use built-in fetch in Node.js.
- This issue is particularly relevant to Windows systems.
- The payload is a (known trojan)[https://www.virustotal.com/gui/file/c4504c579025dcd492611f3a175632e22c2d3b881fda403174499acd6ec39708/detection] with signatures available on VirusTotal.