Critical Malicious Code Vulnerability in basic-with-react-hooks Package
Summary
MAL-2025-4639: Malicious code in basic-with-react-hooks (npm). Affects basic-with-react-hooks versions >= 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The basic-with-react-hooks package is a JavaScript library designed for building React applications using hooks. It simplifies state management and side effects in functional components, making it a popular choice among developers. However, this package has been compromised, leading to significant security risks for any application utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the basic-with-react-hooks package. This code can fully compromise any computer where the package is installed or running. It poses severe risks, including unauthorized access to sensitive information such as secrets and keys. The malicious code can persist even after the package is removed, as it may have granted full control of the system to an external entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall basic-with-react-hooksIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The only recommended action is to remove the package entirely and secure your system.
Conclusion
The basic-with-react-hooks package has been compromised with malicious code, posing significant security risks to any system using it. Immediate removal of the package and rotation of sensitive information is essential to mitigate potential damage. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for basic-with-react-hooks →
FAQ
You should remove the package immediately and rotate any sensitive information stored on the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, system compromise, and potential data breaches.
After removing the package, ensure that all secrets and keys are rotated. However, there is no guarantee that all malicious software has been removed.
It is highly recommended to avoid using the package altogether due to the severity of the compromise, even if an update is available.
