Malicious Code Detected in botframework-webchat-base Package
Summary
MAL-2025-16006: Malicious code in botframework-webchat-base (npm). Affects botframework-webchat-base versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The botframework-webchat-base package is a widely used library in the npm ecosystem, designed to facilitate the integration of web chat functionalities into applications. It provides developers with tools to create interactive chat interfaces, enhancing user engagement. However, this package has recently been identified as containing malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the botframework-webchat-base package stems from the inclusion of malicious code that can compromise the integrity of applications using this library. This code may allow unauthorized access, data exfiltration, or other harmful actions that could affect both the application and its users. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall botframework-webchat-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the botframework-webchat-base package from your project until a secure version is available. You can do this by executing the command: npm uninstall botframework-webchat-base.
Conclusion
The discovery of malicious code in the botframework-webchat-base package highlights the importance of maintaining vigilance in open-source software. Developers are urged to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for botframework-webchat-base →
FAQ
It is a library used for integrating web chat functionalities into applications, enhancing user interaction.
The malicious code can lead to unauthorized access and data exfiltration, posing serious security risks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Consider removing the package from your project as a temporary measure until a secure version is available.
The vulnerability was identified by Amazon Inspector, a security tool that helps in detecting such issues.
