Critical Malicious Code Vulnerability in @gdstudio/web-loader Package
Summary
MAL-2025-5876: Malicious code in @gdstudio/web-loader (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @gdstudio/web-loader package is an npm module designed to facilitate web application development by providing a streamlined way to load and manage web resources. However, it has been identified to contain malicious code, posing a significant risk to systems that utilize it. This vulnerability can compromise the integrity and security of applications relying on this package.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the @gdstudio/web-loader package. This code can lead to unauthorized access and control over the affected systems, allowing attackers to manipulate data, steal sensitive information, and potentially deploy further malicious software. The severity of this vulnerability is underscored by the recommendation that any system with this package installed should be considered fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @gdstudio/web-loaderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily replace the functionality provided by @gdstudio/web-loader with alternative packages that do not have known vulnerabilities. Review your project dependencies and consider using safer, well-maintained packages to achieve similar functionality.
Conclusion
The @gdstudio/web-loader package contains a critical vulnerability due to embedded malicious code, which can severely compromise systems. Immediate action is required to remove the package and secure any affected systems. Utilizing tools like Vulert can help in monitoring and preventing future vulnerabilities.
See every vulnerability recorded for @gdstudio/web-loader →
FAQ
The malicious code can lead to full system compromise, allowing attackers to access sensitive data and control the affected machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Immediately remove the @gdstudio/web-loader package from your project and rotate any secrets or keys stored on the affected system.
Currently, there is no patch available. It is recommended to remove the package until a secure version is released.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert and keep your packages updated to the latest secure versions.
