Critical Malicious Code Vulnerability in adspaces Package
Summary
MAL-2025-6145: Malicious code in adspaces (npm). Affects adspaces versions 99.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The adspaces package is a Node.js library designed for managing advertising spaces within applications. It allows developers to integrate ad placements seamlessly. However, this package has been identified as containing malicious code, which poses significant security risks to any system utilizing it.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the adspaces package. This code can compromise the integrity of any computer that has the package installed, potentially allowing unauthorized access to sensitive information, including secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users are advised to treat any system running this package as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall adspacesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to uninstall the adspaces package immediately. You can do this by running the following command in your terminal: npm uninstall adspaces. Additionally, rotate all secrets and keys stored on the affected system from a secure environment.
Conclusion
The adspaces package has been identified as containing malicious code that poses serious security risks. Immediate action is required to uninstall the package and secure any sensitive information. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for adspaces →
FAQ
You should uninstall the adspaces package immediately and rotate any sensitive information stored on the affected system.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Failing to address this vulnerability may lead to unauthorized access to sensitive data, complete system compromise, and potential data breaches.
As of now, there is no patch available. The recommended action is to uninstall the package until a secure version is released.
After removing the package, rotate all secrets and keys, and monitor your system for any unusual activity to ensure it remains secure.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
