Critical Malicious Code Vulnerability in boatyard Package
Summary
MAL-2025-15920: Malicious code in boatyard (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The boatyard package is a tool designed for managing and deploying applications in a streamlined manner. It offers features such as configuration management, deployment automation, and integration with various cloud services. However, it has been identified to contain malicious code that poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in the boatyard package originates from the inclusion of malicious code that can compromise the security of applications using this package. This malicious code can lead to unauthorized access, data breaches, and potential exploitation of the affected systems. Users are advised to be cautious as this vulnerability can affect any version of the package starting from its introduction.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall boatyardIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the boatyard package from their project until a secure version is available. This can be done by executing the command: npm uninstall boatyard.
Conclusion
The boatyard package has been identified to contain malicious code that poses serious security risks. Users are strongly encouraged to update their packages to the latest version or uninstall it until a secure version is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for boatyard →
FAQ
The malicious code can lead to unauthorized access and potential exploitation of user data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Currently, all versions of boatyard are affected. Users should update to the latest patched version as soon as it is released.
As a temporary measure, consider uninstalling the boatyard package until a secure version is available.
Detailed information can be found in the vulnerability report on GitHub: https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boatyard/MAL-2025-15920.json.
