Malicious Code Detected in eslint-plugin-react_editor: Version 71.71.72 Compromised
Summary
MAL-2025-6812: Malicious code in eslint-plugin-react_editor (npm). Affects eslint-plugin-react_editor versions 71.71.72. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
eslint-plugin-react_editor is an npm package designed to provide linting capabilities for React applications. It helps developers maintain code quality by identifying potential errors and enforcing coding standards. However, version 71.71.72 of this package has been flagged for malicious behavior, specifically for communicating with domains associated with harmful activities.
Vulnerability Detail
The vulnerability in eslint-plugin-react_editor arises from its malicious code that enables communication with a domain linked to malicious activities. This could lead to data breaches, unauthorized access to sensitive information, or the execution of harmful scripts within the user's environment. The package was identified as malicious by the OpenSSF Package Analysis project, which traced its origins to a specific commit hash, indicating a deliberate insertion of harmful code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eslint-plugin-react_editorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the eslint-plugin-react_editor package from your project until a secure version is confirmed. Use the following command to uninstall the package: npm uninstall eslint-plugin-react_editor. This will prevent any potential malicious activity while you seek an alternative solution.
Conclusion
The eslint-plugin-react_editor package version 71.71.72 has been identified as malicious, posing serious security risks to users. It is essential to update to a secure version or remove the package until a fix is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for eslint-plugin-react_editor →
FAQ
eslint-plugin-react_editor is an npm package that provides linting tools for React applications, helping developers maintain code quality.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 71.71.72 for communicating with a domain associated with malicious activities.
Using the compromised version can lead to data breaches, unauthorized access, and execution of harmful scripts, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
