Malicious Code Detected in box-lib-node: A Critical Vulnerability Overview
Summary
MAL-2025-6405: Malicious code in box-lib-node (npm). Affects box-lib-node versions 1.0.5 – 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The box-lib-node package is an npm library designed to facilitate interactions with the Box API, allowing developers to manage files and folders in the Box cloud storage service. This package is utilized in various applications for its ease of use and integration capabilities. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant security risks to applications that depend on it.
Vulnerability Detail
The vulnerability identified in box-lib-node stems from the inclusion of malicious code in versions 1.0.5 and 1.0.6. This code can potentially compromise the security of applications using the package, leading to unauthorized access to sensitive data or system resources. The malicious code was discovered by ReversingLabs and is documented in their findings. The impact of this vulnerability can be severe, as it may allow attackers to execute arbitrary code or gain control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall box-lib-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to remove the box-lib-node package from your project until a secure version can be implemented. This can be done by executing:
npm uninstall box-lib-node
This will prevent the malicious code from executing in your application.
Conclusion
The box-lib-node package has been found to contain malicious code in specific versions, posing a serious security threat to applications that utilize it. Users are strongly advised to update to the latest version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring your applications remain secure.
See every vulnerability recorded for box-lib-node →
FAQ
Versions 1.0.5 and 1.0.6 of box-lib-node contain the malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can uninstall the box-lib-node package to prevent any potential exploitation until you can update.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, execution of arbitrary code, and potential control over the affected systems.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
