Malicious Code Injection in capacitorandroidpermissions: A Critical Security Threat
Summary
MAL-2025-47398: Malicious code in capacitorandroidpermissions (npm). Affects capacitorandroidpermissions versions 0.0.4 – 0.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The capacitorandroidpermissions package is an npm library designed to facilitate the management of Android permissions in Capacitor applications. It provides developers with an easy way to request and handle permissions required for their applications to function correctly on Android devices. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability stems from a compromise of the capacitorandroidpermissions package, which was infiltrated by the Shai-Hulud NPM worm. This malicious payload is designed to steal sensitive tokens and credentials from users and subsequently publish this information to GitHub. Furthermore, it has the capability to propagate itself to other npm packages owned by the affected user, amplifying the risk of widespread exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall capacitorandroidpermissionsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to remove the compromised package from their project until a secure version is confirmed. This can be done by executing the following command: npm uninstall capacitorandroidpermissions. Additionally, review your project for any unauthorized changes or dependencies that may have been introduced by the malicious code.
Conclusion
The capacitorandroidpermissions package has been compromised, leading to the introduction of malicious code that can steal sensitive information and propagate itself to other packages. It is crucial for users to update to the latest version and monitor their projects for any signs of exploitation.
See every vulnerability recorded for capacitorandroidpermissions →
FAQ
It is an npm library used for managing Android permissions in Capacitor applications, allowing developers to request and handle necessary permissions.
The package was compromised by the Shai-Hulud NPM worm, which injected malicious code into the package.
The risks include unauthorized access to sensitive tokens and credentials, which can lead to data breaches and unauthorized actions on behalf of the user.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If affected, immediately update the package to the latest version, remove the compromised package, and review your project for any unauthorized changes.
