Malicious Code Detected in ido-sdk-web Package - Version 99.99.2
Summary
MAL-2025-192357: Malicious code in ido-sdk-web (npm). Affects ido-sdk-web versions 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ido-sdk-web package is a JavaScript library used in web development, providing various functionalities for developers. It is part of the npm ecosystem, which allows for easy integration and management of packages in JavaScript applications. However, version 99.99.2 of this package has been flagged for malicious behavior, raising concerns about its safety and integrity.
Vulnerability Detail
The vulnerability in the ido-sdk-web package arises from its communication with a domain linked to malicious activities. Additionally, the package executes commands that are associated with harmful behavior, potentially compromising the security of applications that utilize it. This could lead to unauthorized access, data breaches, or other malicious outcomes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ido-sdk-webIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the ido-sdk-web package from your project until a secure version is released. You can do this by running the following command: npm uninstall ido-sdk-web. This will prevent any malicious code from executing in your application.
Conclusion
The ido-sdk-web package version 99.99.2 has been flagged for malicious behavior, which poses significant security risks. It is essential to update or remove the package to protect your application from potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ido-sdk-web →
FAQ
ido-sdk-web is a JavaScript library used for web development, providing various functionalities for developers.
Version 99.99.2 of the ido-sdk-web package is identified as malicious.
The risks include unauthorized access, data breaches, and execution of harmful commands that could compromise application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider removing the package from your project as a temporary measure to avoid potential security risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
