Malicious Code Detected in @wptv/components: A Critical Security Concern
Summary
MAL-2025-6068: Malicious code in @wptv/components (npm). Affects @wptv/components versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @wptv/components package is a library used in web development, providing reusable components for building user interfaces. It is designed to streamline the development process by offering pre-built elements that enhance functionality and aesthetics. However, this package has been flagged for a serious vulnerability that allows it to communicate with a domain linked to malicious activities, posing a risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the @wptv/components package arises from its ability to connect to a domain associated with malicious activities. This could lead to unauthorized data access, potential data breaches, or the execution of harmful code within applications that depend on this package. The issue was introduced in version 1.0.0 and remains a significant threat to users who have not updated to a secure version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @wptv/componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @wptv/components package from your project until a secure version is available. Alternatively, you can implement network security measures to block outgoing connections to the malicious domain associated with this package.
Conclusion
The @wptv/components package has been identified as having a critical vulnerability that allows communication with a malicious domain. It is crucial for developers using this package to update to a secure version promptly or implement workarounds to mitigate risks. Regular monitoring with tools like Vulert can help maintain application security.
See every vulnerability recorded for @wptv/components →
FAQ
The vulnerability allows the package to communicate with a domain linked to malicious activities, which can compromise application security.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you to any issues. Visit Vulert Scanner for a quick check without needing to sign up.
Consider removing the package from your project or implementing network security measures to block connections to the malicious domain.
Yes, updating to the latest version of the @wptv/components package will address the vulnerability.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, data breaches, or the execution of harmful code within your application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
