Critical Malicious Code Vulnerability in fb-error Package
Summary
MAL-2025-3886: Malicious code in fb-error (npm). Affects fb-error versions 0.1.0 – 9.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fb-error package is a Node.js library used for error handling in applications. It provides developers with a structured way to manage and log errors, enhancing the debugging process. However, this package has been found to contain malicious code, posing significant security risks to any application that utilizes it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the fb-error package. This code can compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The origin of this vulnerability is linked to a malicious actor who has manipulated the package, leading to potential full control over affected systems. Users are advised to treat any system running this package as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fb-errorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily replace the fb-error package with an alternative error handling library until a safe version is released. Consider using libraries like 'express-error-handler' or 'http-errors' for managing errors in your application.
Conclusion
The fb-error package has been identified as containing malicious code that compromises the security of any system using it. Immediate action is required to remove the package and secure sensitive information. Users are encouraged to monitor for updates and consider alternative libraries for error handling in the meantime.
See every vulnerability recorded for fb-error →
FAQ
You should remove the fb-error package immediately and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
Currently, there is no patch available. It is recommended to remove the package until a safe version is released.
Failing to address this vulnerability can lead to unauthorized access to sensitive data and complete control over your system by malicious actors.
No, it is advised not to reinstall the fb-error package until a verified safe version is released.
