Malicious Code Vulnerability in Circuit Playground Package
Summary
MAL-2026-1692: Malicious code in circuit-playground (npm). Affects circuit-playground versions 66.55.16 – 999.55.17. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Circuit Playground is an npm package designed for educational purposes, particularly in the realm of electronics and programming. It provides users with tools and libraries to interact with various hardware components. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability stems from malicious code embedded in specific versions of the Circuit Playground package. This code can potentially compromise the integrity of applications that utilize the package, leading to unauthorized access, data breaches, or other harmful actions. The affected versions include 66.55.16, 66.55.17, and 999.55.17, as identified by ReversingLabs. Users of these versions are at risk and should take immediate action to mitigate potential threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall circuit-playgroundIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the affected versions of the Circuit Playground package from their projects and refrain from using it until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The Circuit Playground package has been identified as containing malicious code in specific versions, posing serious security risks to users. It is crucial to update to the latest version to protect your applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for circuit-playground →
FAQ
The affected versions include 66.55.16, 66.55.17, and 999.55.17.
You should immediately update the package to the latest version using the command: npm install circuit-playground@latest.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Using the affected package can lead to unauthorized access, data breaches, and other harmful actions that compromise your application's security.
Yes, Vulert can monitor your package-lock.json file to alert you in real-time for any open-source vulnerabilities in your software.
