Malicious Code Detected in g2a-tooltip Package - Security Alert
Summary
MAL-2025-21102: Malicious code in g2a-tooltip (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The g2a-tooltip package is an npm library designed to provide tooltip functionality for web applications. It is commonly used to enhance user interfaces by displaying additional information when users hover over elements. However, this package has been identified as containing malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the g2a-tooltip package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code could potentially allow unauthorized access to sensitive data, execute arbitrary commands, or facilitate other malicious activities. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall g2a-tooltipIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the g2a-tooltip package from your project until a secure version is released. You can do this by running the following command: npm uninstall g2a-tooltip. Alternatively, you may explore other tooltip libraries that do not have known vulnerabilities.
Conclusion
The g2a-tooltip package has been identified as containing malicious code that poses a security risk to applications. Developers are advised to update or remove the package to mitigate potential threats. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for g2a-tooltip →
FAQ
g2a-tooltip is an npm package that provides tooltip functionality for web applications, enhancing user experience.
The malicious code can compromise application security, potentially allowing unauthorized access to sensitive data or executing harmful commands.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
As of now, it is crucial to check the package repository for any updates or patches that address the vulnerability.
If immediate updates are not possible, consider removing the g2a-tooltip package or using alternative libraries until a secure version is released.
