Malicious Code Detected in date-lima-pibx Package
Summary
MAL-2025-18040: Malicious code in date-lima-pibx (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The date-lima-pibx package is an npm library that is designed to provide date manipulation functionalities. It is commonly used in JavaScript applications for handling dates and times. However, this package has been found to contain malicious code, which poses a significant risk to applications that depend on it.
Vulnerability Detail
The vulnerability in the date-lima-pibx package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious code was introduced in version 0 and has been flagged for its potential to cause severe ramifications for users and their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall date-lima-pibxIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar date manipulation functionalities without the associated risks. Always ensure to review the package's security status before integrating it into your project.
Conclusion
The date-lima-pibx package has been flagged for containing malicious code, posing a significant risk to applications that utilize it. Users are advised to uninstall the package and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for date-lima-pibx →
FAQ
The date-lima-pibx package is an npm library used for date manipulation in JavaScript applications.
The malicious code was identified by security researchers and reported through Amazon Inspector.
Using the compromised package can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json. Check your application at Vulert Scanner.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
