Malicious Code Detected in cressida-commitlint-config-angular-proteomics-development Package
Summary
MAL-2025-17679: Malicious code in cressida-commitlint-config-angular-proteomics-development (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cressida-commitlint-config-angular-proteomics-development package is designed for configuring commit linting in Angular projects. It helps maintain consistent commit messages by enforcing rules. However, this package has been compromised, containing malicious code that can pose significant risks to users and their projects.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the cressida-commitlint-config-angular-proteomics-development package. This malicious code can potentially lead to unauthorized access, data breaches, or the execution of harmful actions within the user's environment. The package is affected from version 0 onwards, making all versions vulnerable.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cressida-commitlint-config-angular-proteomics-developmentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using an alternative commit linting configuration package that is known to be secure until the vulnerability is addressed in the affected package.
Conclusion
The cressida-commitlint-config-angular-proteomics-development package has been identified as containing malicious code, posing significant risks to users. It is crucial to uninstall the package and consider alternatives until a secure version is released. Utilizing tools like Vulert can help monitor and manage vulnerabilities in your projects effectively.
See every vulnerability recorded for cressida-commitlint-config-angular-proteomics-development →
FAQ
It is a package used to configure commit linting for Angular projects, ensuring that commit messages adhere to specified rules.
The specific nature of the malicious code has not been disclosed, but it poses risks such as unauthorized access and potential data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your package-lock.json file, you can check for vulnerabilities in real-time.
The best mitigation strategy is to uninstall the affected package and consider using a secure alternative until a patched version is released.
Immediately uninstall the package and review your project for any potential impacts caused by the malicious code.
