Malicious Code Detected in hcs-image-viewer Package - Security Alert
Summary
MAL-2025-6813: Malicious code in hcs-image-viewer (npm). Affects hcs-image-viewer versions 1.0.0 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The hcs-image-viewer package is an npm library designed for displaying images in a user-friendly interface. It offers features such as image scaling, zooming, and basic editing functionalities. However, recent analysis has revealed that certain versions of this package contain malicious code that compromises user security.
Vulnerability Detail
The vulnerability in the hcs-image-viewer package arises from its communication with a domain linked to malicious activities. This behavior poses significant risks, including data theft, unauthorized access to user systems, and potential exploitation of the affected applications. The malicious nature of the package was identified by the OpenSSF Package Analysis project, which flagged versions 1.0.0 and 1.0.2 as harmful.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hcs-image-viewerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the hcs-image-viewer package from their project until a secure version is released. This can be done by executing the following command: npm uninstall hcs-image-viewer. Alternatively, consider using a different image viewer package that does not have known vulnerabilities.
Conclusion
The hcs-image-viewer package has been identified as containing malicious code, posing significant security risks to users. It is crucial to update or remove the affected versions to protect your applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for hcs-image-viewer →
FAQ
Versions 1.0.0 and 1.0.2 of the hcs-image-viewer package are confirmed to contain malicious code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider removing the package from your project as a temporary measure until a secure version is available.
The malicious code can lead to unauthorized data access, potential data breaches, and exploitation of your application by attackers.
Yes, tools like Vulert allow you to monitor your package dependencies for vulnerabilities in real-time using just your package-lock.json file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
