Critical Malicious Code Vulnerability in react-scrambled-text Package
Summary
MAL-2025-191415: Malicious code in react-scrambled-text (npm). Affects react-scrambled-text versions 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The react-scrambled-text package is an npm library designed to obfuscate text in a scrambled format, often used in web applications to protect sensitive information from being easily read. However, this package has been compromised, making it a significant security risk for any application that utilizes it. The vulnerability stems from malicious code embedded within the package, which can lead to severe security breaches.
Vulnerability Detail
The vulnerability in the react-scrambled-text package is rooted in its compromise by the Sha1-Hulud: The Second Coming NPM worm. This malicious payload is designed to steal tokens and credentials, publishing them to GitHub. It can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. Additionally, it poses a risk of destroying the user's home directory, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-scrambled-textIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily replace the functionality provided by react-scrambled-text with an alternative library that offers similar text obfuscation features. Ensure that the alternative library is well-reviewed and has no known vulnerabilities.
Conclusion
The react-scrambled-text package has been compromised by malicious code, posing a severe security threat to any application using it. Immediate action is required to remove the package and secure any affected systems. Users should also consider alternative libraries for text obfuscation to maintain security.
See every vulnerability recorded for react-scrambled-text →
FAQ
You should immediately remove the package from your project and rotate any secrets or credentials stored on the affected machine.
The malicious code can steal sensitive tokens and credentials, potentially compromising your application's security and exposing it to further attacks.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
It is highly recommended to find an alternative library for text obfuscation, as the react-scrambled-text package is compromised and poses a security risk.
If not addressed, this vulnerability can lead to unauthorized access to sensitive information, loss of data, and potential damage to your application's reputation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
