Malicious Code Injection in ansi-regex Package: Critical Vulnerability Alert
Summary
MAL-2025-46966: Malicious code in ansi-regex (npm). Affects ansi-regex versions 6.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ansi-regex package is a widely used library in the Node.js ecosystem that provides a way to match ANSI escape codes in strings. It is commonly utilized in applications for formatting terminal output. However, a recent compromise has introduced malicious code into version 6.2.1, making it a significant security risk for developers and users alike.
Vulnerability Detail
The vulnerability stems from the introduction of malicious code within the ansi-regex package, specifically in version 6.2.1. This compromise allows attackers to gain unauthorized access to systems where the package is installed, potentially leading to data breaches and the exposure of sensitive information. The malicious code can execute arbitrary commands, thereby compromising the integrity of the host system. Users are advised to treat any system running this package as fully compromised and to take immediate action to secure their environments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ansi-regexIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the affected package from your project until a secure version is confirmed. Use the following command to uninstall the package:
npm uninstall ansi-regex
Additionally, ensure that you rotate any secrets or keys that may have been exposed due to the vulnerability.
Conclusion
The ansi-regex package has been compromised, introducing malicious code that poses a significant security threat. Users must take immediate action to update or remove the affected version to protect their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for ansi-regex →
FAQ
ansi-regex is a Node.js library used to match ANSI escape codes in strings, commonly used for formatting terminal output.
The package was compromised by the introduction of malicious code in version 6.2.1, which allows unauthorized access to systems.
You should immediately uninstall the affected version and update to the latest version of the package to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application with the Vulert playground at Vulert Scanner.
Failure to address this vulnerability could lead to unauthorized access, data breaches, and loss of sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for ansi-regex.
