Malicious Code Detected in bmatrix Package - Security Alert
Summary
MAL-2025-15904: Malicious code in bmatrix (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bmatrix package is a JavaScript library available on npm, designed for mathematical operations involving matrices. It is commonly used in applications requiring complex calculations, such as data analysis and scientific computing. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users who integrate it into their projects.
Vulnerability Detail
The vulnerability in the bmatrix package stems from the inclusion of malicious code that can compromise the integrity of applications utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The issue was introduced in version 0 and affects all subsequent versions, making it critical for users to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bmatrixIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can isolate the bmatrix package in a separate environment to limit its impact on the main application. However, this is not a permanent solution and should not be relied upon for long-term security.
Conclusion
The discovery of malicious code in the bmatrix package poses a serious threat to users and their applications. Immediate action is required to remove the package and prevent potential security breaches. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure the safety of your software.
See every vulnerability recorded for bmatrix →
FAQ
bmatrix is a JavaScript library for performing mathematical operations on matrices, commonly used in data analysis and scientific applications.
The malicious code can lead to unauthorized access and potential data breaches, compromising the security of applications that use the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
You should remove the bmatrix package from your project and consider using a secure alternative. If a patched version is released, update to that version immediately.
The best course of action is to avoid using the bmatrix package altogether. If you must use it, isolate it in a separate environment to limit its impact.
