Malicious Code Detected in beag.ly Package - Security Alert
Summary
MAL-2025-15553: Malicious code in beag.ly (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The beag.ly package is an npm library designed for URL shortening and redirection. It allows users to create short links that redirect to longer URLs, making sharing easier. However, this package has been found to contain malicious code, posing a significant security risk to users and applications that rely on it.
Vulnerability Detail
The vulnerability in the beag.ly package arises from the inclusion of malicious code that can compromise user data and system integrity. This code may execute unauthorized actions, leading to data breaches or system exploitation. The issue was introduced in version 0 and affects all subsequent versions, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall beag.lyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can temporarily disable any functionalities that rely on the beag.ly package until a secure alternative is implemented. Additionally, consider using other URL shortening services that are known to be secure.
Conclusion
The beag.ly package has been identified as containing malicious code, posing a serious security threat. Users are advised to remove the package and seek secure alternatives to protect their applications and data.
See every vulnerability recorded for beag.ly →
FAQ
The beag.ly package is used for creating short URLs that redirect to longer URLs, facilitating easier sharing.
The malicious code can execute unauthorized actions, potentially leading to data breaches and system exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Currently, there is no patched version available for beag.ly. It is recommended to remove the package and use a secure alternative.
You should immediately remove the beag.ly package from your project and replace it with a secure alternative to mitigate security risks.
