Malicious Code Detected in @toptal/picasso-utils: Security Alert
Summary
MAL-2025-6067: Malicious code in @toptal/picasso-utils (npm). Affects @toptal/picasso-utils versions 3.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @toptal/picasso-utils package is a utility library designed for use in data visualization and UI component development within JavaScript applications. It provides various tools and components that enhance the functionality and aesthetics of applications. However, this package has been identified as having a vulnerability that allows it to communicate with a domain associated with malicious activity, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability in the @toptal/picasso-utils package stems from its communication with a domain linked to malicious activities. This could lead to unauthorized data access, data exfiltration, or other security breaches. The package's reliance on external domains for functionality increases the risk of exposure to malicious actors who may exploit this communication channel for nefarious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @toptal/picasso-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @toptal/picasso-utils package from your project until a secure version is available. To do this, run the following command: npm uninstall @toptal/picasso-utils. Alternatively, consider using an alternative library that provides similar functionality without the associated risks.
Conclusion
The @toptal/picasso-utils package has been identified with a serious vulnerability that allows communication with a malicious domain. It is crucial to address this issue by updating the package or implementing workarounds to safeguard your application. Regular monitoring and updates are essential to maintain security in your software.
See every vulnerability recorded for @toptal/picasso-utils →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, posing a risk to user data and application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not feasible, consider removing the package or using an alternative library until a secure version is released.
Check the official repository or npm page for @toptal/picasso-utils for any updates or patched versions that resolve this issue.
Ignoring this vulnerability could lead to unauthorized access to sensitive data, data breaches, and potential exploitation of your application by malicious actors.
