Critical Security Breach in @livecms/live-edit: Malicious Code Detected
Summary
MAL-2025-191241: Malicious code in @livecms/live-edit (npm). Affects @livecms/live-edit versions 0.0.32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @livecms/live-edit package is an npm module designed for live editing capabilities in web applications. It allows developers to implement real-time content updates, enhancing user experience and interactivity. However, this package has been compromised, exposing users to severe security risks.
Vulnerability Detail
The vulnerability stems from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from users, publishing them to GitHub. It propagates itself to other npm packages owned by the user and can establish persistence through GitHub actions. Additionally, it poses a risk of destroying the user's home directory, leading to potential data loss and further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @livecms/live-editIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users should consider removing the affected package from their project until a secure version is available. This can be done by executing: npm uninstall @livecms/live-edit. Additionally, review your GitHub actions and remove any unauthorized scripts or actions that may have been introduced by the worm.
Conclusion
The @livecms/live-edit package has been compromised by a malicious worm that poses serious security risks to users. Immediate action is required to update or remove the affected package to safeguard sensitive information and maintain system integrity. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for @livecms/live-edit →
FAQ
The malicious code is designed to steal sensitive information such as tokens and credentials, and it can also propagate itself to other npm packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If you have installed version 0.0.32 or any affected version, you should uninstall it immediately and update to the latest secure version.
Yes, the worm has the potential to destroy your home directory, leading to significant data loss and system compromise.
Regularly update your dependencies, use tools like Vulert for monitoring, and audit your packages for known vulnerabilities.
