Malicious Code Detected in bby-page-objects Package
Summary
MAL-2025-15540: Malicious code in bby-page-objects (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bby-page-objects package is a Node.js library designed to facilitate the creation and management of page object models in automated testing frameworks. It provides developers with a structured approach to writing tests, promoting code reuse and maintainability. However, this package has been found to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the bby-page-objects package stems from the inclusion of malicious code that can compromise the integrity and security of applications. This code may lead to unauthorized data access, data manipulation, or even remote code execution, depending on how the package is integrated into the application. The malicious code was introduced in version 0 and has not been rectified in any subsequent releases, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bby-page-objectsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the bby-page-objects package altogether and explore other libraries that offer similar features for managing page object models in automated testing. For instance, consider using 'webdriverio' or 'puppeteer' as alternatives.
Conclusion
The bby-page-objects package has been identified as containing malicious code that poses serious security threats to applications. Users are strongly advised to uninstall the package and consider alternative solutions to ensure the safety and integrity of their applications.
See every vulnerability recorded for bby-page-objects →
FAQ
The bby-page-objects package is a Node.js library used for creating and managing page object models in automated testing frameworks.
The malicious code can lead to unauthorized data access, data manipulation, or remote code execution, posing significant security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
No, there is currently no patched version available for the bby-page-objects package, making it crucial to remove it from your project.
Consider using libraries like 'webdriverio' or 'puppeteer' as alternatives for managing page object models in your automated testing.
