Malicious Code Detected in fe-extension Package - Security Alert
Summary
MAL-2025-20337: Malicious code in fe-extension (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fe-extension package is an npm library designed to enhance browser functionalities through extensions. It allows developers to create and manage browser extensions easily. However, this package has been identified as containing malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the fe-extension package. This code can potentially compromise user data, facilitate unauthorized access, or lead to other security breaches. The malicious nature of this code was identified by security researchers, highlighting the importance of scrutinizing third-party packages before integration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fe-extensionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the fe-extension package until a safe version is released. Consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The discovery of malicious code in the fe-extension package underscores the importance of vigilance when using third-party libraries. Developers should take immediate action to remove the affected package and consider alternatives to safeguard their applications.
See every vulnerability recorded for fe-extension →
FAQ
The fe-extension package is an npm library used for developing browser extensions, allowing developers to enhance browser capabilities.
The malicious code was identified by security researchers from Amazon Inspector, who monitor open-source packages for vulnerabilities.
Using the fe-extension package can lead to unauthorized access to user data, security breaches, and potential exploitation of your application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you have already integrated the fe-extension package, it is recommended to remove it immediately and look for alternative solutions.
