Malicious Code Detected in bh-elements Package - Security Alert
Summary
MAL-2025-15653: Malicious code in bh-elements (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bh-elements package is a JavaScript library used in web development for creating and managing various UI elements. It is designed to simplify the process of building interactive web applications. However, this package has been found to contain malicious code, posing a significant security risk to developers and users who integrate it into their projects.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the bh-elements package. This code can potentially compromise the security of applications that utilize the package, leading to unauthorized access, data breaches, or other malicious activities. The issue affects all versions starting from 0, making it imperative for users to take immediate action to protect their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bh-elementsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to remove the bh-elements package from their project until a secure version is released. This can be done by executing the command: 'npm uninstall bh-elements'. Alternatively, consider using a different package that provides similar functionality without the security risks.
Conclusion
The discovery of malicious code in the bh-elements package poses a serious threat to users and developers. Immediate action is required to mitigate risks, including updating or removing the package. Stay informed about updates and consider using tools like Vulert to monitor your applications for vulnerabilities.
See every vulnerability recorded for bh-elements →
FAQ
bh-elements is a JavaScript library used for creating and managing UI elements in web applications.
The malicious code can lead to unauthorized access and potential data breaches in applications that use the package.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to Vulert's playground at Vulert Scanner to check for vulnerabilities.
As of now, there is no patched version available. Users should monitor the package repository for updates.
If removal is not possible, consider implementing additional security measures and monitoring your application closely until a secure version is released.
