Malicious Code Detected in frontend-release-manager Package
Summary
MAL-2025-5693: Malicious code in frontend-release-manager (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The frontend-release-manager is an npm package designed to facilitate the management of frontend releases in web applications. It allows developers to streamline their deployment processes and manage version control effectively. However, this package has been found to contain embedded malicious code, posing significant security risks to any system that utilizes it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the frontend-release-manager package. This code can compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to full system compromise, data breaches, and potential exploitation by malicious actors. The specific technical aspects involve the package being flagged for containing code that appears to be malicious in nature, as identified by the Open Source Vulnerability database.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall frontend-release-managerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the frontend-release-manager package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, ensure that all secrets and keys stored on the affected computer are rotated immediately from a secure system.
Conclusion
The frontend-release-manager package has been identified as containing malicious code, which poses a significant security threat to systems that utilize it. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor for updates and consider alternative solutions.
See every vulnerability recorded for frontend-release-manager →
FAQ
You should remove the package immediately and rotate any secrets or keys stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Currently, there is no patched version available. It is recommended to remove the package until a safe version is released.
Failing to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential exploitation by attackers.
It is highly discouraged to continue using the package, as it may still pose risks even if you believe you do not store sensitive information.
