Malicious Code Detected in react-mandes: A Critical Vulnerability Alert
Summary
MAL-2025-191582: Malicious code in react-mandes (npm). Affects react-mandes versions 1.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-mandes is an npm package designed for creating and managing React components. It offers a variety of features that facilitate component development, making it a popular choice among developers. However, recent findings have revealed that this package is compromised, posing significant risks to applications that depend on it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the react-mandes package, specifically in version 1.1.4. This code can potentially lead to unauthorized access, data breaches, or other harmful actions within applications that utilize this package. The origin of this malicious code is linked to a package identified by ReversingLabs, which has raised alarms about its impact on the security of dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-mandesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the react-mandes package from your project until a secure version is confirmed. You can do this by running the following command: npm uninstall react-mandes. This will prevent any potential exploitation of the vulnerability while you seek alternatives.
Conclusion
The discovery of malicious code in the react-mandes package highlights the importance of vigilance in managing open-source dependencies. Developers are urged to update or remove the affected package to safeguard their applications from potential threats.
See every vulnerability recorded for react-mandes →
FAQ
The vulnerability involves malicious code that can compromise the security of applications using the react-mandes package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider removing the package temporarily to mitigate risks.
The vulnerability was identified by ReversingLabs, a cybersecurity firm specializing in threat detection.
While specific exploits have not been detailed, the presence of malicious code indicates a high risk of exploitation.
