Embedded Malicious Code Affecting @zapier/browserslist-config-zapier package, versions =1.0.3=1.0.4=1.0.5
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ZAPIERBROWSERSLISTCONFIGZAPIER-14103236
- published24 Nov 2025
- disclosed24 Nov 2025
- creditHelixGuard Team
Introduced: 24 Nov 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @zapier/browserslist-config-zapier package.
Overview
Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of spreading through NPM dependencies to compromise developer environments.
Malicious Behavior
The obfuscated payload targets and steals sensitive information, including API tokens, environment variables, and private repository credentials.
The malware actively modifies package files to inject itself into other dependencies, facilitating further spread across the ecosystem.
The malware also creates a GitHub repository under compromised accounts with a random name with the description: "Sha1-Hulud: The Second Coming"