Critical Malicious Code Vulnerability in atrix Package
Summary
MAL-2025-190764: Malicious code in atrix (npm). Affects atrix versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The atrix package is a Node.js library commonly used in web development for various functionalities. It provides developers with tools to enhance their applications. However, this package has been identified as containing malicious code that compromises the security of any system it is installed on, making it a significant risk for users and developers alike.
Vulnerability Detail
The vulnerability in the atrix package is classified as embedded malicious code, which poses a severe threat to any computer that has this package installed. The malicious code can lead to unauthorized access, data breaches, and potential control of the affected system by external entities. Users should consider any system with this package fully compromised, and all secrets and keys stored on that system should be rotated immediately. The origin of this vulnerability is linked to the package being flagged by the GitHub Security Advisory as containing harmful code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall atrixIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should ensure that they have rotated any secrets or keys that may have been compromised. Additionally, they should monitor their systems for any unusual activity that may indicate ongoing malicious actions.
Conclusion
The atrix package has been identified as containing malicious code, posing a significant security risk to any system it is installed on. Users are urged to remove the package immediately and take necessary precautions to secure their systems. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for atrix →
FAQ
The atrix package is a Node.js library used for various functionalities in web development.
A package containing malicious code can compromise the security of a system, allowing unauthorized access and control by external entities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
You should immediately remove the atrix package and rotate any secrets or keys stored on your system.
Currently, there is no mention of a patch. Users should focus on removing the package and securing their systems.
