Malicious Code Vulnerability in focaleys Package
Summary
MAL-2026-17329: Malicious code in focaleys (npm). Affects focaleys versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The focaleys package is an npm library designed for specific functionalities within JavaScript applications. It allows developers to integrate various features seamlessly. However, it has been identified to have a critical vulnerability due to its dependency management, which can lead to the execution of unverified code during installation.
Vulnerability Detail
The vulnerability arises from the focaleys package declaring a dependency on 'libsignal' from a GitHub repository without specifying a version, tag, or commit SHA. This means that when users install focaleys, the package manager fetches the latest code from the default branch of the repository, which can be altered by the repository owner at any time. This lack of integrity checks allows malicious code to be executed on the installer's machine, posing significant security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall focaleysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually install a specific version of the libsignal dependency that you trust. Use the following command to install a specific version: npm install libsignal@<trusted_version>. Replace <trusted_version> with the version number you wish to install.
Conclusion
The focaleys package has a significant vulnerability due to its dependency management practices, allowing for the potential execution of malicious code. It is crucial to update the package or implement workarounds to mitigate risks. Regular monitoring using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for focaleys →
FAQ
Focaleys is an npm package used in JavaScript applications for various functionalities, but it has a vulnerability related to its dependency management.
The vulnerability allows unverified code to run on your machine during the installation of the focaleys package, which can lead to security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
If you cannot update the package, consider using a specific version of the libsignal dependency that you trust as a temporary workaround.
For more information, you can reach out to Amazon Inspector at inspector-research@amazon.com.
