Malicious Code Detected in ariary Package - Security Alert
Summary
MAL-2025-14822: Malicious code in ariary (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ariary package is an npm library designed for handling currency conversions and related financial calculations. It is widely used in applications that require accurate currency data and conversion functionalities. However, the package has recently been flagged for containing malicious code, which poses significant security risks to applications relying on it.
Vulnerability Detail
The vulnerability in the ariary package stems from the inclusion of malicious code that can compromise the integrity of applications using it. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ariaryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the ariary package from your project until a secure version is released. You can do this by running: npm uninstall ariary. Alternatively, explore other packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the ariary package highlights the importance of maintaining security in open-source software. Users are urged to take immediate action to mitigate risks by updating or removing the affected package. Stay vigilant and utilize tools like Vulert to monitor your dependencies for vulnerabilities.
See every vulnerability recorded for ariary →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data or execute harmful actions within the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
As of now, a patched version has not been released. Users should monitor the package repository for updates.
Consider removing the package from your project or using an alternative package until a secure version is available.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
