Malicious Code Detected in b3dtiles-sample Package - Immediate Action Required
Summary
MAL-2025-191507: Malicious code in b3dtiles-sample (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The b3dtiles-sample package is an npm library designed for handling 3D tiles in web applications. It provides developers with tools to efficiently manage and render 3D spatial data. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the b3dtiles-sample package, which has been flagged by Amazon Inspector for containing malicious code. This code can potentially compromise the integrity of applications, leading to unauthorized access, data breaches, or other malicious activities. The vulnerability affects all versions of the package, making it critical for users to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall b3dtiles-sampleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using an alternative package that provides similar functionality without the security risks associated with b3dtiles-sample. Always ensure to review the security status of any package before integrating it into your project.
Conclusion
The discovery of malicious code in the b3dtiles-sample package highlights the importance of vigilant dependency management in software development. Immediate action is required to mitigate risks associated with this vulnerability. Utilize tools like Vulert to stay informed about potential threats to your applications.
See every vulnerability recorded for b3dtiles-sample →
FAQ
b3dtiles-sample is an npm package used for managing and rendering 3D tiles in web applications.
It means that the package has been found to include harmful code that can compromise the security of applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
You should uninstall the package immediately and look for alternative solutions or wait for a patched version to be released.
Regularly monitor your dependencies using tools like Vulert and keep your packages updated to their latest secure versions.
