Malicious Code Injection in @art-ws/http-server: A Critical Security Threat
Summary
MAL-2025-47379: Malicious code in @art-ws/http-server (npm). Affects @art-ws/http-server versions 2.0.21 – 2.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @art-ws/http-server package is a Node.js server that allows developers to serve web content easily. It is commonly used in various applications for its simplicity and efficiency. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability stems from the Shai-Hulud NPM worm, which compromised the @art-ws/http-server package. The malicious code embedded within this package is designed to steal tokens and credentials from users and publish them to GitHub. Furthermore, it has the capability to propagate itself to other NPM packages owned by the affected user, amplifying the risk of widespread compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @art-ws/http-serverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the affected package from their project until they can update to a secure version. This can be done by executing the command: npm uninstall @art-ws/http-server.
Conclusion
The @art-ws/http-server package has been compromised, leading to the introduction of malicious code that poses significant security threats. Users are strongly advised to update to the latest secure versions or remove the package until they can ensure their systems are safe. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for @art-ws/http-server →
FAQ
The malicious code is designed to steal sensitive information such as tokens and credentials and publish them to GitHub.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider uninstalling the package as a temporary measure to mitigate risks.
Yes, the safe versions of the package are 2.0.25 and 2.0.21. Ensure to update to one of these versions.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights without requiring code access.
