Malicious Code Detected in Glitchpy Package - Security Alert
Summary
MAL-2025-21576: Malicious code in glitchpy (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Glitchpy is an npm package designed to facilitate the creation and management of glitch effects in web applications. It is widely used by developers for its ease of integration and functionality. However, recent findings have revealed that the package contains malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the glitchpy package originates from the inclusion of malicious code that can compromise the security of applications using this package. This code may allow unauthorized access, data theft, or other harmful actions that can affect both developers and end-users. The malicious nature of this code was identified by security researchers, highlighting the importance of scrutinizing third-party packages before integration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall glitchpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the glitchpy package from your project until a secure version is available. You can do this by executing the command: 'npm uninstall glitchpy'. This will prevent any potential exploitation of the malicious code.
Conclusion
The discovery of malicious code in the glitchpy package underscores the importance of vigilance when using third-party libraries. Developers are encouraged to update their dependencies promptly and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for glitchpy →
FAQ
Glitchpy is an npm package used for creating glitch effects in web applications, enhancing visual aesthetics.
The malicious code can lead to unauthorized access and data theft, posing significant risks to applications using the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, uninstall the glitchpy package using 'npm uninstall glitchpy' to mitigate risks until a secure version is available.
Utilize tools like Vulert, which provides real-time monitoring for open-source vulnerabilities by analyzing your package-lock.json file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
