Malicious Code Detected in armoauth Package - Security Alert
Summary
MAL-2025-14837: Malicious code in armoauth (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The armoauth package is a Node.js library designed for OAuth authentication, allowing developers to integrate secure login functionalities into their applications. It is widely used due to its ease of use and flexibility. However, recent findings have revealed that this package contains malicious code, posing significant risks to users and their applications.
Vulnerability Detail
The vulnerability in the armoauth package stems from the inclusion of malicious code that can compromise the security of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions. The issue was introduced in version 0 and affects all subsequent versions. Developers using this package are at risk of exploitation, which could have severe consequences for their applications and users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall armoauthIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the armoauth package from your project until a secure version is available. You can do this by executing the command: 'npm uninstall armoauth'. This will help mitigate the risk of exploitation while you seek alternatives or await a patch.
Conclusion
The armoauth package has been identified as containing malicious code, posing a significant security risk to applications that utilize it. It is crucial for developers to update or remove this package to protect their applications and users. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for armoauth →
FAQ
The armoauth package is used for implementing OAuth authentication in Node.js applications, allowing secure user login functionalities.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update the package right away, consider removing it from your project as a temporary workaround to reduce the risk of exploitation.
Yes, there are several alternatives available for OAuth authentication in Node.js, such as Passport.js or OAuth2orize, which you can consider using.
The vulnerability was discovered by Amazon Inspector, a security tool that helps identify vulnerabilities in software packages.
