Malicious Code Detected in floradex Package - Security Alert
Summary
MAL-2025-20713: Malicious code in floradex (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The floradex package is an npm library designed for managing floral data and related functionalities. It offers features such as flower categorization, data retrieval, and user interaction. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The floradex package has been identified to contain malicious code that can compromise the integrity and security of applications using it. This vulnerability originated from the package's source code, which was intentionally modified to include harmful scripts. The ramifications of this vulnerability can range from data theft to unauthorized access to sensitive information, making it crucial for users to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall floradexIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the floradex package until a secure version is released. Alternatively, consider using other packages that offer similar functionalities without the associated risks.
Conclusion
The floradex package has been compromised with malicious code, posing serious security threats to applications that utilize it. Users are advised to update the package immediately or seek alternatives until a secure version is released. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for floradex →
FAQ
Floradex is an npm package designed for managing floral data and related functionalities.
The malicious code can lead to data theft and unauthorized access to sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, refrain from using the floradex package until a secure version is available or consider alternative packages.
The vulnerability was identified by Amazon Inspector, a security tool that helps in detecting vulnerabilities in software packages.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
