Malicious Code Detected in aps-simple-viewer-nodejs Package - Critical Vulnerability Alert
Summary
MAL-2025-191564: Malicious code in aps-simple-viewer-nodejs (npm). Affects aps-simple-viewer-nodejs versions 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aps-simple-viewer-nodejs package is a Node.js library designed for rendering simple views in applications. It is commonly used in web development to facilitate the display of content. However, this package has been identified as containing malicious code, which poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within version 2.0.0 of the aps-simple-viewer-nodejs package. This code can potentially compromise the security of applications by allowing unauthorized access or manipulation of data. The malicious package was reported by ReversingLabs and is documented in their findings. Users of this package should be aware of the risks associated with using compromised libraries, as they can lead to data breaches and loss of integrity in applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall aps-simple-viewer-nodejsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the aps-simple-viewer-nodejs package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall aps-simple-viewer-nodejs.
Conclusion
The aps-simple-viewer-nodejs package has been identified as containing malicious code, posing significant risks to applications. It is crucial for developers to update their dependencies and utilize tools like Vulert to ensure the security of their applications. By staying informed and proactive, developers can mitigate the risks associated with open-source vulnerabilities.
See every vulnerability recorded for aps-simple-viewer-nodejs →
FAQ
It is a Node.js library used for rendering simple views in web applications.
The malicious code can allow unauthorized access and manipulation of application data.
You can use Vulert to monitor and alert for vulnerabilities in your application by analyzing the package-lock.json file.
Regularly update your dependencies and use tools like Vulert to monitor for vulnerabilities in real-time.
Consider removing the package temporarily until a secure version is available.
