Critical Malicious Code Vulnerability in @blocks-shared/desktop-title Package
Summary
MAL-2025-6027: Malicious code in @blocks-shared/desktop-title (npm). Affects @blocks-shared/desktop-title versions >= 2.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @blocks-shared/desktop-title package is a component within the npm ecosystem that is designed to facilitate desktop title management for applications. It is utilized by developers to enhance user interface elements related to application titles. However, this package has been identified to communicate with a domain associated with malicious activities, raising significant security concerns for users and developers alike.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain linked to malicious activities, which could potentially lead to data breaches, unauthorized access, or other security threats. This issue was introduced in version 2.99.99 and affects all subsequent versions. Users of this package are at risk of exploitation due to the inherent trust placed in the package's functionality, which is now compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @blocks-shared/desktop-titleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the package from your project until a secure version is available. You can do this by running the command: npm uninstall @blocks-shared/desktop-title. Additionally, monitor your application for any suspicious activity that may arise from the use of this package.
Conclusion
The @blocks-shared/desktop-title package has a critical vulnerability that allows communication with a malicious domain, posing significant risks to users. It is essential to update the package or remove it from your project to mitigate these risks. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for @blocks-shared/desktop-title →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider uninstalling the package temporarily and monitoring your application for any unusual behavior.
Currently, the vulnerability was introduced in version 2.99.99. Ensure you are using a version prior to this to avoid the issue.
You can reach out to Amazon Inspector at actran@amazon.com for further inquiries regarding this vulnerability.
