Malicious Code Vulnerability in uglify-parse-socket-new-error Package
Summary
MAL-2025-190027: Malicious code in uglify-parse-socket-new-error (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The uglify-parse-socket-new-error package is part of the npm ecosystem, typically used for parsing and handling socket errors in JavaScript applications. However, this package has been identified as part of a malicious campaign that floods the npm registry with derivative packages to inflate developer reputation scores for token rewards. Its functionality is compromised due to the presence of malicious scripts that alter its behavior.
Vulnerability Detail
This vulnerability originates from a malicious payload embedded within the uglify-parse-socket-new-error package. The payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which leads to the continuous republishing of variants that pollute the npm registry. This can result in security risks for developers who inadvertently use these compromised packages, potentially exposing their applications to further vulnerabilities and malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uglify-parse-socket-new-errorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the uglify-parse-socket-new-error package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities in real-time.
Conclusion
The uglify-parse-socket-new-error package has been identified as containing malicious code that poses significant security risks. It is crucial for developers to remove this package and monitor their applications for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your software by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for uglify-parse-socket-new-error →
FAQ
It is an npm package used for parsing socket errors in JavaScript applications, but it has been compromised with malicious code.
You can use Vulert, which monitors your package-lock.json for vulnerabilities. You can check your application using the Vulert playground without any signup.
Using the compromised package can lead to security vulnerabilities, including exposure to malicious scripts that can alter your application’s behavior.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay updated with security advisories from the npm registry.
Remove the package immediately and monitor your application for any unusual behavior. Consider replacing it with a secure alternative.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
