Malicious Package Affecting tensorflowjs package, versions *
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TENSORFLOWJS-12670374
- published15 Sept 2025
- disclosed13 Sept 2025
- creditSafeDep
Introduced: 13 Sep 2025
Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the tensorflowjs package.
Overview
tensorflowjs is a malicious package. This package contains malicious code that uses a sophisticated typosquatting attack. It employs multi-stage malware with heavy obfuscation to evade detection. The malware's primary function is to steal credentials and capture screenshots from Windows machines. It also establishes a command and control channel via a Discord server.