Malicious Code Detected in angular-sources Package - Vulnerability MAL-2025-6819
Summary
MAL-2025-6819: Malicious code in angular-sources (npm). Affects angular-sources versions 999.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The angular-sources package is an npm library that is often utilized for sourcing Angular-related components and functionalities. It is designed to facilitate developers in integrating Angular features into their applications seamlessly. However, the package has been flagged for containing malicious code, specifically in version 999.0.0, which poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the angular-sources package arises from its communication with a domain associated with malicious activity. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the affected systems. The malicious code can compromise the integrity of applications using this package, making it critical for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall angular-sourcesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the angular-sources package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall angular-sources. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The angular-sources package has been identified as malicious due to its communication with harmful domains. It is crucial for developers to take immediate action by updating or removing the affected package to safeguard their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for angular-sources →
FAQ
The angular-sources package is an npm library used for integrating Angular components into applications, facilitating easier development.
A malicious package contains code that can harm users' systems, often by communicating with harmful domains or executing unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you are using version 999.0.0 of angular-sources, it is recommended to uninstall the package and update to a secure version as soon as possible.
Yes, consider exploring other npm packages that offer similar functionalities without the associated security risks.
