Critical Malicious Code Vulnerability in hover-design-prototype Package
Summary
MAL-2025-190965: Malicious code in hover-design-prototype (npm). Affects hover-design-prototype versions 0.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hover-design-prototype package is an npm library designed for creating interactive hover effects in web applications. It is commonly used by developers to enhance user interfaces with visually appealing transitions. However, this package has been found to contain malicious code that poses significant security risks to systems using it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the hover-design-prototype package, specifically version 0.0.5. This code can compromise any computer that has the package installed, allowing attackers to gain unauthorized access to sensitive information, including secrets and keys stored on the affected system. The malicious nature of the code is classified under CWE-506, indicating that it embeds harmful functionalities that can lead to severe security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hover-design-prototypeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the hover-design-prototype package in your project until a secure version is released. Additionally, ensure that all secrets and keys stored on the affected computer are rotated immediately from a different, secure machine.
Conclusion
The hover-design-prototype package has been identified as containing malicious code that poses serious security risks. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help monitor for future vulnerabilities effectively.
See every vulnerability recorded for hover-design-prototype →
FAQ
You should immediately remove the package from your project and rotate any sensitive information stored on the affected machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your package-lock.json file to check for vulnerabilities.
Currently, there is no patched version available. The best action is to remove the package entirely.
Failing to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential loss of sensitive information.
You can use tools like Vulert, which allows you to monitor your project for vulnerabilities in real-time without needing to access the code or installation.
