Critical Malicious Code Vulnerability in @actbase/react-native-less-transformer Package
Summary
MAL-2025-190710: Malicious code in @actbase/react-native-less-transformer (npm). Affects @actbase/react-native-less-transformer versions 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @actbase/react-native-less-transformer package is a tool used in React Native applications to transform LESS stylesheets into CSS. It is designed to streamline the styling process for developers, allowing them to utilize the LESS preprocessor within their React Native projects. However, this package has been found to contain malicious code, posing significant security risks to users and their systems.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the @actbase/react-native-less-transformer package. This code can compromise any computer that has the package installed or running, potentially allowing unauthorized access to sensitive information, including secrets and keys. The ramifications of this vulnerability are severe, as it may lead to full control of the affected system by an external entity, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @actbase/react-native-less-transformerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should ensure that the package is uninstalled and that they do not run any applications relying on it. Additionally, they should monitor their systems for any unusual activity that may indicate further compromise.
Conclusion
The @actbase/react-native-less-transformer package has been identified as containing malicious code that poses a serious security threat. Users are urged to take immediate action by removing the package and securing their systems. Continuous monitoring for vulnerabilities is essential, and tools like Vulert can assist in maintaining security.
See every vulnerability recorded for @actbase/react-native-less-transformer →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Currently, there is no patched version available. Users are advised to remove the package entirely.
Failing to address this vulnerability can lead to unauthorized access to your system and sensitive data, potentially resulting in data breaches.
Vulert monitors and alerts users in real-time for open-source vulnerabilities using just the package-lock.json file, making it easy to stay informed.
