Critical Malicious Code Vulnerability in allcodes Package (npm)
Summary
MAL-2025-14322: Malicious code in allcodes (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The allcodes package is a JavaScript library available in the npm ecosystem, designed to facilitate various coding functionalities. It is widely used by developers for its ease of integration and utility. However, recent findings have revealed that this package contains malicious code that can compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the allcodes package, which was introduced in version 0. This malicious code can lead to unauthorized access, data breaches, or other harmful actions within applications that depend on this package. The implications of this vulnerability are severe, as it can affect the integrity and confidentiality of user data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall allcodesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the allcodes package from your project until a secure version is released. Use the following command to uninstall the package: 'npm uninstall allcodes'.
Conclusion
The discovery of malicious code in the allcodes package poses a significant risk to applications that utilize it. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Utilizing tools like Vulert can enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for allcodes →
FAQ
The malicious code can perform unauthorized actions, potentially leading to data breaches or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Currently, it is recommended to avoid using the allcodes package until a patched version is released.
If immediate removal is not possible, ensure to monitor your application closely for any suspicious activity and consider implementing additional security measures.
Utilize tools like Vulert to receive real-time alerts about vulnerabilities in your open-source dependencies.
