Critical Malicious Code Vulnerability in login-oauth Package
Summary
MAL-2025-6103: Malicious code in login-oauth (npm). Affects login-oauth versions >= 13.3.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The login-oauth package is an npm library designed to facilitate OAuth authentication in web applications. It provides developers with a streamlined way to implement login features using various OAuth providers. However, this package has been identified as having a serious vulnerability that allows it to communicate with a domain associated with malicious activities, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability in the login-oauth package originates from version 13.3.7, where the package is found to communicate with a domain linked to malicious activities. This can lead to unauthorized access to sensitive user information, data breaches, and exploitation of the application by attackers. The technical aspect of this vulnerability lies in the package's ability to send requests to a harmful domain, which can result in severe security implications for applications utilizing this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall login-oauthIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the login-oauth package from your project until a secure version is available. You can do this by executing the following command: npm uninstall login-oauth. Alternatively, consider using a different authentication library that does not have known vulnerabilities.
Conclusion
The login-oauth package has a critical vulnerability that allows it to communicate with a malicious domain, posing significant risks to applications using it. It is essential to update the package to a secure version or implement workarounds to mitigate potential threats. Regular monitoring with tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for login-oauth →
FAQ
The login-oauth package is used to implement OAuth authentication in web applications, allowing users to log in using various OAuth providers.
The risks include unauthorized access to user data, potential data breaches, and exploitation of the application by malicious actors.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, updating the login-oauth package to a patched version will resolve the vulnerability. Use the command 'npm update login-oauth' to update.
If you cannot update the package immediately, consider removing it from your project or using an alternative authentication library until a secure version is available.
