Critical Malicious Code Vulnerability in react-linear-loader Package
Summary
MAL-2025-190993: Malicious code in react-linear-loader (npm). Affects react-linear-loader versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The react-linear-loader package is a JavaScript library used in web development to create linear loading indicators. It is commonly utilized in applications to enhance user experience by providing visual feedback during loading processes. However, this package has been found to contain malicious code, posing significant security risks to any application that incorporates it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the react-linear-loader package, specifically version 1.0.2. This code can compromise any system where the package is installed, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to complete system compromise, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-linear-loaderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should consider using alternative packages that provide similar functionality without the associated risks. Additionally, ensure that all sensitive information is stored securely and consider rotating any secrets that may have been exposed.
Conclusion
The discovery of malicious code in the react-linear-loader package underscores the importance of vigilance in managing open-source dependencies. Users must take immediate action to protect their systems by removing the affected package and monitoring for any potential updates or patches.
See every vulnerability recorded for react-linear-loader →
FAQ
react-linear-loader is a JavaScript library used to create linear loading indicators in web applications.
The malicious code can compromise the system, allowing unauthorized access to sensitive information and potentially leading to full system control.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should immediately uninstall the package and rotate any secrets or keys that may have been compromised.
As of now, there is no patched version available. Users should remove the package and monitor for updates.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
