Malicious Code Detected in bluebutton-hapi Package
Summary
MAL-2025-15881: Malicious code in bluebutton-hapi (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bluebutton-hapi package is an npm module designed to facilitate the integration of Blue Button APIs, which allow users to access their health data. It is commonly used in healthcare applications to improve data interoperability and user experience. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the bluebutton-hapi package stems from the presence of malicious code that can compromise the integrity and security of applications using this package. This malicious code could potentially lead to unauthorized access to sensitive data, data manipulation, or other harmful actions that could affect both the application and its users. The issue was introduced in all versions starting from 0, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bluebutton-hapiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the bluebutton-hapi package from their project until a secure version is released. This can be done using the command: 'npm uninstall bluebutton-hapi'. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The bluebutton-hapi package has been identified to contain malicious code, which poses significant risks to applications that utilize it. Users are strongly advised to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bluebutton-hapi →
FAQ
The bluebutton-hapi package is an npm module that helps integrate Blue Button APIs for accessing health data in applications.
The exact nature of the malicious code has not been disclosed, but it poses risks such as unauthorized data access and manipulation.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your package-lock.json file to check for vulnerabilities.
Yes, you can temporarily uninstall the bluebutton-hapi package or use alternative packages until a secure version is available.
Detailed information can be found on the GitHub repository of the malicious package, as well as through security advisories related to npm packages.
