Malicious Code Detected in @mparpaillon/imagesloaded Package - Security Alert
Summary
MAL-2025-190871: Malicious code in @mparpaillon/imagesloaded (npm). Affects @mparpaillon/imagesloaded versions 4.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @mparpaillon/imagesloaded package is a JavaScript library used in web development to detect when images have been loaded. It provides functionality to enhance user experience by ensuring that images are displayed correctly and efficiently. However, this package has been found to contain malicious code, which poses a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the @mparpaillon/imagesloaded package. This code can potentially compromise the security of applications that depend on this library, leading to unauthorized access, data breaches, or other malicious activities. The specific version identified with this vulnerability is 4.1.2, and it has been flagged by Amazon Inspector as a significant threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @mparpaillon/imagesloadedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @mparpaillon/imagesloaded package from your project and replacing it with a trusted alternative that provides similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the @mparpaillon/imagesloaded package highlights the importance of maintaining secure dependencies in software development. By updating to a patched version or replacing the package, developers can mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can further enhance security by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for @mparpaillon/imagesloaded →
FAQ
The malicious code can perform unauthorized actions within applications, potentially leading to data theft or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Consider removing the @mparpaillon/imagesloaded package and replacing it with a secure alternative until you can perform the update.
Regularly check the repositories of the packages you use and consider using tools like Vulert for real-time monitoring of vulnerabilities.
