Critical Malicious Code Vulnerability in htmlbars-inline-precompile Package
Summary
MAL-2025-5700: Malicious code in htmlbars-inline-precompile (npm). Affects htmlbars-inline-precompile versions >= 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
htmlbars-inline-precompile is an npm package that allows developers to compile HTML templates inline within JavaScript code. It is commonly used in web applications to enhance rendering performance and maintainability. However, this package has been identified to contain malicious code, posing significant security risks to any system utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the htmlbars-inline-precompile package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code means that simply removing the package may not eliminate all threats, as full control of the affected system may have been granted to an external entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall htmlbars-inline-precompileIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to uninstall the htmlbars-inline-precompile package immediately. You can do this by executing the following command: npm uninstall htmlbars-inline-precompile. Additionally, ensure that you rotate any secrets or keys that may have been compromised.
Conclusion
The htmlbars-inline-precompile package has been found to contain malicious code, posing a serious security threat to any systems that utilize it. Immediate action is required to remove the package and secure any compromised information. Regular monitoring and updates are essential to maintain the security of your applications.
See every vulnerability recorded for htmlbars-inline-precompile →
FAQ
htmlbars-inline-precompile is used to compile HTML templates inline within JavaScript, improving performance and maintainability in web applications.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you have installed the htmlbars-inline-precompile package, you should uninstall it immediately and rotate any sensitive information that may have been compromised.
Not necessarily. While removing the package is essential, there may still be residual malicious software on your system. It is advisable to conduct a thorough security audit.
As of now, there is no specific patch available. It is recommended to monitor the package's repository for any updates or patches that may address this vulnerability.
