Critical Malicious Code Vulnerability in core-icon Package
Summary
MAL-2025-17575: Malicious code in core-icon (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The core-icon package is an npm library designed to provide a set of icon components for web applications. It is widely used in various projects for its ease of integration and customizable features. However, recent findings have revealed that this package contains malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the core-icon package, which was introduced in version 0 and affects all subsequent versions. This malicious code can lead to unauthorized access, data breaches, and potential exploitation of the systems that rely on this package. Users of the core-icon package are strongly advised to take immediate action to mitigate the risks associated with this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall core-iconIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the core-icon package from your project until a secure version is available. This can be done by executing the following command: npm uninstall core-icon. Consider using alternative icon libraries that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the core-icon package poses a serious threat to applications that utilize it. Users are urged to update the package or remove it from their projects to safeguard their systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for core-icon →
FAQ
The core-icon package is an npm library that provides a collection of icon components for use in web applications.
The specific nature of the malicious code has not been disclosed, but it poses significant security risks, including unauthorized access and data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file to check for vulnerabilities without needing to install any software.
Yes, it is recommended to update to the latest version of the core-icon package where the vulnerability has been addressed.
If immediate updates are not feasible, consider removing the package or using alternative libraries until a secure version is available.
