Critical Malicious Code Vulnerability in @fishingbooker/react-loader Package
Summary
MAL-2025-191221: Malicious code in @fishingbooker/react-loader (npm). Affects @fishingbooker/react-loader versions 1.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fishingbooker/react-loader package is a JavaScript library designed for use in React applications, providing a simple way to implement loading indicators. However, this package has been compromised, leading to significant security concerns. The vulnerability allows malicious code to execute, potentially compromising user data and system integrity.
Vulnerability Detail
The vulnerability originates from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is capable of stealing tokens and credentials, publishing them to GitHub, and propagating itself to other NPM packages owned by the user. Additionally, it may establish persistence through GitHub actions and could even destroy the user's home directory. Any system running this package should be considered fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @fishingbooker/react-loaderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The only recommended action is to uninstall the compromised package and ensure that all sensitive information is secured.
Conclusion
The @fishingbooker/react-loader package has been compromised, leading to a critical vulnerability that can severely impact system security. Immediate action is required to mitigate risks, including uninstalling the package and securing sensitive information. Regular monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for @fishingbooker/react-loader →
FAQ
You should immediately uninstall the package and rotate any secrets or keys stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability can lead to unauthorized access to sensitive data, potential data loss, and further propagation of malicious code.
Currently, there is no patched version available. The best course of action is to uninstall the package.
The malicious code was introduced by the Sha1-Hulud: The Second Coming NPM worm, which compromises systems and steals sensitive information.
