Critical Malicious Code Vulnerability in formik-store Package
Summary
MAL-2025-191097: Malicious code in formik-store (npm). Affects formik-store versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The formik-store package is a JavaScript library used in conjunction with Formik, a popular form management library for React applications. It provides state management for form data, making it easier for developers to handle form submissions and validations. However, this package has been identified as containing malicious code that compromises the security of any system where it is installed.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the formik-store package, specifically version 1.0.1. This code can lead to complete compromise of the affected system, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it embeds harmful functionality that can be exploited by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall formik-storeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages for state management in your forms, such as Redux or React's built-in state management features, until a secure version of formik-store is released.
Conclusion
The formik-store package has been identified as containing malicious code that poses a significant security risk. Immediate action is required to uninstall the package and secure any sensitive information. Users are encouraged to explore alternative solutions for form state management until a safe version is available.
See every vulnerability recorded for formik-store →
FAQ
You should uninstall the formik-store package immediately and rotate any sensitive information stored on the affected system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
No, there is currently no patched version of formik-store available. It is recommended to uninstall the package.
Failing to remove the package can lead to unauthorized access to your system, potentially compromising sensitive data and allowing attackers to execute malicious actions.
Yes, you can still use Formik by managing state through alternative methods or libraries that do not pose security risks.
