Malicious Code Detected in atomicphp Package - Security Alert
Summary
MAL-2025-15024: Malicious code in atomicphp (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The atomicphp package is an npm library designed for PHP-related functionalities, offering developers tools to streamline PHP development processes. However, it has been identified to contain malicious code, posing significant security risks to applications that utilize this package.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the atomicphp package, which was introduced in version 0. This code can potentially compromise the security of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. The presence of such code raises serious concerns about the integrity and safety of the software ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall atomicphpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the atomicphp package from your project until a secure version is released. You can do this by running: 'npm uninstall atomicphp'. This will prevent any potential exploitation of the malicious code.
Conclusion
The atomicphp package has been found to contain malicious code, posing a serious threat to applications that utilize it. It is essential to update or remove the package to mitigate risks. Regular monitoring for vulnerabilities is recommended to maintain application security.
See every vulnerability recorded for atomicphp →
FAQ
The atomicphp package is an npm library that provides tools for PHP development, aimed at enhancing the efficiency of PHP-related tasks.
The malicious code was introduced in version 0 of the atomicphp package, compromising its security.
Using the atomicphp package with malicious code can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
