Malicious Code Detected in accounts-base Package - Version 23.5.6
Summary
MAL-2025-191480: Malicious code in accounts-base (npm). Affects accounts-base versions 23.5.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'accounts-base' package is a widely used npm module that provides a base for user account management in web applications. It offers functionalities such as user registration, login, and account management features. However, version 23.5.6 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability stems from the identification of malicious code within the 'accounts-base' package version 23.5.6, as reported by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior, which could potentially compromise the security of applications utilizing this package. Users of this version are at risk of unauthorized access and data breaches due to the malicious actions embedded in the code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall accounts-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'accounts-base' package from your project until a secure version is confirmed. Use the following command to uninstall it: npm uninstall accounts-base. Consider using alternative packages for user account management in the meantime.
Conclusion
The 'accounts-base' package version 23.5.6 has been identified as malicious, posing significant security risks to applications that utilize it. It is crucial to update to a secure version and consider using alternative packages if necessary. Regular monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for accounts-base →
FAQ
The 'accounts-base' package is an npm module that provides essential functionalities for user account management in web applications, including registration and login features.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 23.5.6 of the 'accounts-base' package for executing commands associated with malicious activities.
Using the compromised version can lead to unauthorized access, data breaches, and potential exploitation of your application by malicious actors.
Yes, updating to the latest version of the 'accounts-base' package will resolve the vulnerability. Always check for the most recent and secure version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
