Malicious Code Injection in @art-ws/prettier: A Critical Security Threat
Summary
MAL-2025-47382: Malicious code in @art-ws/prettier (npm). Affects @art-ws/prettier versions 1.0.5 – 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @art-ws/prettier package is a JavaScript library designed to format code consistently. It is widely used in various projects to ensure code quality and readability. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to its users.
Vulnerability Detail
The vulnerability stems from a compromise of the @art-ws/prettier package, which was infected by the Shai-Hulud NPM worm. This malicious payload is designed to steal tokens and credentials from users and publish them to GitHub. Additionally, it can propagate itself to other NPM packages owned by the affected user, leading to widespread security breaches and potential data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @art-ws/prettierIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the @art-ws/prettier package from their project until a secure version is confirmed. This can be done using the command: npm uninstall @art-ws/prettier. Additionally, consider using alternative formatting tools that are not affected by this vulnerability.
Conclusion
The @art-ws/prettier package has been compromised, leading to the introduction of malicious code that can steal sensitive information and propagate to other packages. It is essential for users to update to the latest version of the package and monitor their applications for any signs of compromise. Utilizing tools like Vulert can help in maintaining security in open-source projects.
See every vulnerability recorded for @art-ws/prettier →
FAQ
The Shai-Hulud NPM worm is a malicious code that infects NPM packages, stealing sensitive information and spreading itself to other packages owned by the user.
You can use the Vulert platform to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you suspect that your application has been compromised, immediately remove the affected package and change any credentials that may have been exposed.
Yes, the worm can propagate to other NPM packages owned by the user, so it is crucial to audit all packages in your project.
Regularly update your packages, use tools like Vulert for monitoring, and review your code dependencies to ensure they are from trusted sources.
