Malicious Code Detected in Ably-Realtime Package: Security Alert
Summary
MAL-2025-6070: Malicious code in ably-realtime (npm). Affects ably-realtime versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ably-realtime' package is a popular library used for real-time communication in web and mobile applications. It enables developers to build applications that require instant data updates, such as chat applications, collaborative tools, and live data feeds. However, this package has been identified to communicate with a domain associated with malicious activity, raising significant security concerns for users and developers relying on it.
Vulnerability Detail
The vulnerability in the 'ably-realtime' package stems from its communication with a domain linked to malicious activities. This could potentially expose users to various security threats, including data breaches, unauthorized access, and exploitation of sensitive information. The issue was introduced in version 1.0.0 and remains a critical concern for developers who utilize this package in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ably-realtimeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the 'ably-realtime' package from your project until a secure version is released. You can do this by executing: 'npm uninstall ably-realtime'. Alternatively, you may explore other real-time communication libraries that do not have this vulnerability.
Conclusion
The 'ably-realtime' package has been identified with a serious vulnerability due to its communication with a malicious domain. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ably-realtime →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, posing risks to user data and application security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is impacted without needing to sign up.
If an immediate update is not possible, consider removing the package or using alternative libraries until a secure version is available.
While specific exploits have not been detailed, the communication with a malicious domain raises concerns about potential data breaches and unauthorized access.
Regularly check the official repository of the 'ably-realtime' package and utilize tools like Vulert to receive real-time alerts on vulnerabilities.
