Critical Malicious Code Vulnerability in ado-codespaces-auth Package
Summary
MAL-2025-5885: Malicious code in ado-codespaces-auth (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ado-codespaces-auth package is an npm library designed to facilitate authentication for Azure DevOps Codespaces. It is utilized by developers to streamline their workflow in cloud-based development environments. However, this package has been identified to contain malicious code that compromises the security of any system where it is installed.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the ado-codespaces-auth package. This code can lead to a complete compromise of any computer running the package, allowing unauthorized access to sensitive information, including secrets and keys. The malicious nature of this code poses significant risks, as it may enable attackers to control the affected systems remotely, leading to potential data breaches and loss of integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ado-codespaces-authIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate removal of the package is not feasible, consider isolating the affected system from the network to prevent further unauthorized access while you prepare to remove the package and secure your environment.
Conclusion
The ado-codespaces-auth package contains embedded malicious code that poses a serious security threat. Immediate action is required to remove the package and secure any compromised systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for ado-codespaces-auth →
FAQ
You should remove the package immediately and rotate any secrets or keys stored on the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
Keeping this package can lead to unauthorized access to your system, potential data breaches, and loss of sensitive information.
The best mitigation is to remove the package entirely. If removal is not possible immediately, isolate the system from the network.
While removing the package is essential, there is no guarantee that all malicious software has been eliminated. It is advisable to conduct a thorough security audit of the system.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
