Malicious Code Vulnerability in adobe-cr Package
Summary
MAL-2025-6398: Malicious code in adobe-cr (npm). Affects adobe-cr versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The adobe-cr package is an npm library designed for Adobe Creative Cloud integrations, providing functionalities that enhance user experience with Adobe products. However, it has been identified to contain malicious code that poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability, identified as MAL-2025-6398, originates from a malicious version of the adobe-cr package (version 1.0.0). This version includes harmful code that can compromise the security of applications using it, potentially leading to unauthorized access, data breaches, or other malicious activities. The vulnerability was discovered by ReversingLabs and is documented in their database.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall adobe-crIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the adobe-cr package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall adobe-cr. This will prevent any malicious code from executing in your application.
Conclusion
The adobe-cr package has been identified to contain malicious code, posing significant security risks to applications that utilize it. It is crucial to update or remove the package to safeguard your application from potential threats. Utilizing tools like Vulert can help monitor and alert you to such vulnerabilities in real-time.
See every vulnerability recorded for adobe-cr →
FAQ
The adobe-cr package is an npm library used for integrating Adobe Creative Cloud functionalities into applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected. Visit the Vulert playground at Vulert Scanner for a quick check without signup.
If immediate updates are not possible, consider removing the adobe-cr package from your project as a temporary measure to mitigate risks.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection and analysis.
Using the compromised adobe-cr package can lead to unauthorized access, data breaches, and other malicious activities that can severely impact your application's security.
