Malicious Code Detected in o2-modal Package: Version 97.1.0 Compromised
Summary
MAL-2025-190608: Malicious code in o2-modal (npm). Affects o2-modal versions 97.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The o2-modal package is a popular npm library used for creating modal dialogs in web applications. It provides developers with a simple and customizable way to implement modals, enhancing user experience. However, version 97.1.0 of this package has been flagged for malicious behavior, raising concerns about its security and integrity.
Vulnerability Detail
The vulnerability in the o2-modal package arises from its communication with a domain known for malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of users' systems. The origin of this vulnerability was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its suspicious network activity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall o2-modalIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the o2-modal package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall o2-modal. Alternatively, consider using a different modal library that has a proven track record of security.
Conclusion
The o2-modal package version 97.1.0 has been identified as malicious, posing significant security risks to users. It is crucial to update to a secure version or remove the package to protect your application from potential threats. Regular monitoring and vulnerability checks are essential for maintaining software security.
See every vulnerability recorded for o2-modal →
FAQ
o2-modal is an npm package used for creating modal dialogs in web applications, providing a user-friendly interface for developers.
The vulnerability was discovered by the OpenSSF Package Analysis project, which identified the package's communication with a domain associated with malicious activity.
Using the compromised version can lead to unauthorized data access, potential data breaches, and exploitation of user systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider removing the package or using an alternative library until a secure version is available.
