Malicious Code Injection in baso51 Package: A Threat to npm Users
Summary
MAL-2025-181409: Malicious code in baso51 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The baso51 package is part of the npm ecosystem, which is widely used for JavaScript package management. It is often utilized by developers to manage dependencies in their applications. However, this package has been identified as part of a malicious campaign that aims to exploit npm's publishing capabilities, leading to potential security risks for users who inadvertently install it.
Vulnerability Detail
The vulnerability in the baso51 package stems from its association with a malicious campaign that floods the npm registry with derivative packages. These packages contain scripts designed to modify the package.json file, removing private flags and changing version numbers. This behavior allows the package to continuously republish variants with randomized names, thereby polluting the npm registry and inflating developer reputation scores for token rewards. The malicious payload can lead to unintended consequences for developers, including the installation of compromised packages and potential exposure of sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall baso51If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the baso51 package and monitor your project for any dependencies that may have been affected by this malicious code. Regularly check your package-lock.json file for any unauthorized changes.
Conclusion
The baso51 package poses a significant threat to npm users due to its malicious code designed to exploit the npm registry. It is crucial for developers to be vigilant, remove the affected package, and utilize tools like Vulert to monitor for vulnerabilities in their projects.
See every vulnerability recorded for baso51 →
FAQ
The baso51 package is an npm package that has been identified as part of a malicious campaign aimed at exploiting the npm registry.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can help identify if your application is affected.
If you have installed baso51, you should uninstall it immediately using the command 'npm uninstall baso51' and update your dependencies.
Yes, the malicious payload can lead to the installation of compromised packages and may expose sensitive information, making it crucial to remove the package.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about known vulnerabilities in the packages you use.
