Malicious Code Detected in @ra-ide/source-code-frontend Package - Version 31.3.1
Summary
MAL-2025-190594: Malicious code in @ra-ide/source-code-frontend (npm). Affects @ra-ide/source-code-frontend versions 31.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ra-ide/source-code-frontend package is an npm library designed for frontend development, providing various functionalities for source code management and display. However, version 31.3.1 has been flagged for malicious behavior, specifically for communicating with a domain linked to harmful activities, raising significant security concerns for users and developers relying on this package.
Vulnerability Detail
The vulnerability in the @ra-ide/source-code-frontend package arises from its malicious code that enables communication with a domain associated with nefarious activities. This can lead to data breaches, unauthorized access, and potential exploitation of systems using this package. The identification of this issue was made by the OpenSSF Package Analysis project, which highlighted the risks involved with using this specific version of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @ra-ide/source-code-frontendIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package from your project or replacing it with an alternative library that offers similar functionalities without the associated risks. Additionally, you can monitor your project using Vulert, which allows you to check for vulnerabilities in your package-lock.json file without requiring access to the code or installation.
Conclusion
The @ra-ide/source-code-frontend package version 31.3.1 has been identified as malicious due to its communication with a harmful domain. It is essential for developers to update or replace this package to safeguard their applications from potential security threats. Utilizing tools like Vulert can assist in monitoring vulnerabilities effectively.
See every vulnerability recorded for @ra-ide/source-code-frontend →
FAQ
The package communicates with a domain known for malicious activities, which can compromise the security of applications using it.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Consider removing the package or replacing it with a safer alternative until you can update to a patched version.
The vulnerability was identified by the OpenSSF Package Analysis project, which monitors and analyzes packages for malicious behavior.
Yes, continuing to use this package poses a significant risk of data breaches and unauthorized access to your application.
