Malicious Code Detected in flash-hros Package - Security Risk Identified
Summary
MAL-2025-6285: Malicious code in flash-hros (npm). Affects flash-hros versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The flash-hros package is an npm library designed for specific functionalities within JavaScript applications. It is utilized for various tasks, but its recent identification as a conduit for malicious activity raises significant concerns. The package's ability to communicate with potentially harmful domains makes it a target for exploitation, posing risks to applications that depend on it.
Vulnerability Detail
The vulnerability in the flash-hros package stems from its communication with a domain associated with malicious activity. This connection can lead to unauthorized access, data breaches, or the execution of harmful code within applications that utilize this package. The issue was introduced in version 1.0.0, and it is crucial for developers to be aware of the potential ramifications of using this compromised package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall flash-hrosIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the flash-hros package from your project until a secure version is released. You can uninstall it using the following command: npm uninstall flash-hros.
Conclusion
The flash-hros package has been identified as having a serious vulnerability due to its communication with malicious domains. It is essential for developers to take immediate action by updating or removing the package to protect their applications from potential threats.
See every vulnerability recorded for flash-hros →
FAQ
The flash-hros package is an npm library used in JavaScript applications for various functionalities, but it has been identified as having security vulnerabilities.
The package has been found to communicate with domains linked to malicious activities, which can compromise the security of applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider removing the package from your project as a temporary measure to mitigate risks.
Detailed information about the vulnerability can be found on the GitHub repository of the malicious package at https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/flash-hros/MAL-2025-6285.json.
