Malicious Code Vulnerability in proleis-web-animations Package
Summary
MAL-2026-1824: Malicious code in proleis-web-animations (npm). Affects proleis-web-animations versions 10.0.0 – 10.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
proleis-web-animations is an npm package designed to facilitate web animations in JavaScript applications. It provides developers with a set of tools to create smooth and engaging animations, enhancing user experience. However, this package has been identified as containing malicious code, which poses a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within specific versions of the proleis-web-animations package. This code can potentially allow unauthorized access to sensitive data, compromise application integrity, and lead to further exploitation of the system. The affected versions include 10.0.0, 10.0.1, and 10.1.0, which have been flagged for their malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall proleis-web-animationsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the package temporarily from your project until a secure version is available. You can do this by executing: npm uninstall proleis-web-animations.
Conclusion
The proleis-web-animations package has been identified as containing malicious code in certain versions, posing a significant risk to applications. It is crucial to update to the latest version or remove the package to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for proleis-web-animations →
FAQ
The affected versions are 10.0.0, 10.0.1, and 10.1.0.
The malicious code can lead to unauthorized access to sensitive data and compromise the integrity of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Yes, updating to the latest version of proleis-web-animations will resolve the issue.
Consider uninstalling the package temporarily until a secure version is available.
