Malicious Code Detected in Optly Package: Version 90.6.6
Summary
MAL-2025-190600: Malicious code in optly (npm). Affects optly versions 90.6.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Optly is a JavaScript package available on npm, designed to facilitate A/B testing and feature flagging in applications. It allows developers to manage experiments and control feature rollouts efficiently. However, version 90.6.6 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the Optly package arises from its communication with a domain linked to malicious activities. This version executes commands that can compromise the security of applications using it. The origin of this issue was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its harmful behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall optlyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the Optly package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall optly.
Conclusion
The Optly package version 90.6.6 has been identified as malicious, posing significant risks to applications that utilize it. It is crucial to update or remove the package to safeguard your application from potential threats. Utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for optly →
FAQ
The Optly package communicates with a domain associated with malicious activities and executes harmful commands.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider removing the package as a temporary measure to mitigate risks.
While specific exploits have not been detailed, the malicious behavior indicates a risk of unauthorized access or data compromise.
Regularly check for updates on your packages and utilize tools like Vulert to monitor vulnerabilities in your software.
