Malicious Code Detected in angular-base Package - MAL-2025-14522
Summary
MAL-2025-14522: Malicious code in angular-base (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The angular-base package is a JavaScript library used in web development, particularly within the Angular framework ecosystem. It provides foundational functionalities that developers rely on to build scalable and maintainable applications. However, it has been discovered that this package contains malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the angular-base package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code may allow unauthorized access to sensitive data, execute arbitrary commands, or facilitate other malicious activities. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall angular-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the angular-base package from your project until a secure version is released. You can do this by executing the command: 'npm uninstall angular-base'. This will prevent any potential exploitation of the malicious code while you await a fix.
Conclusion
The discovery of malicious code in the angular-base package highlights the importance of maintaining secure dependencies in software development. Developers are urged to update their packages promptly and consider using tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for angular-base →
FAQ
The angular-base package is a JavaScript library designed for use with the Angular framework, providing essential functionalities for web application development.
The malicious code in the angular-base package was identified by security researchers from Amazon Inspector, who reported it as part of their vulnerability findings.
Using the compromised angular-base package can lead to unauthorized access to sensitive data, execution of arbitrary commands, and other malicious activities that can severely impact application security.
As of now, it is crucial to check for any updates or patches for the angular-base package. If a patched version is available, updating the package is the recommended course of action.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert provides real-time alerts without requiring code access or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
