Critical Malicious Code Vulnerability in hopedraw Package
Summary
MAL-2025-190964: Malicious code in hopedraw (npm). Affects hopedraw versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hopedraw package is an npm library designed for drawing and rendering graphics in web applications. It is widely used due to its simplicity and efficiency in handling graphic elements. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users and their systems.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the hopedraw package. This code can compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it embeds harmful functionalities that can lead to severe security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hopedrawIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should consider isolating the affected system from the network and performing a thorough security audit to identify any additional malicious software that may have been installed as a result of the compromised package.
Conclusion
The hopedraw package has been identified to contain malicious code that poses significant security risks. Users are urged to remove the package immediately and take necessary precautions to secure their systems. Utilizing tools like Vulert can help in monitoring and preventing future vulnerabilities.
See every vulnerability recorded for hopedraw →
FAQ
Hopedraw is an npm library used for drawing and rendering graphics in web applications.
If you have the hopedraw package installed, your system may be compromised. It is advisable to remove the package and check for any unauthorized access.
Immediately rotate all secrets and keys stored on the affected system from a secure device to prevent unauthorized access.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
