Critical Malicious Code Vulnerability in lu-anywhere Package
Summary
MAL-2025-6292: Malicious code in lu-anywhere (npm). Affects lu-anywhere versions >= 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'lu-anywhere' package is a JavaScript library used in Node.js applications for various functionalities. It allows developers to integrate location-based features into their applications. However, this package has been identified to communicate with a domain associated with malicious activities, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability arises from the package's ability to connect to a malicious domain, which can lead to unauthorized data access, potential data breaches, and exploitation of the application. This issue was introduced in version 99.99.1 and can affect any application that includes this package, making it critical for developers to address it promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lu-anywhereIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'lu-anywhere' package from your project until a secure version is available. Use the following command to uninstall it: 'npm uninstall lu-anywhere'. This will prevent any potential malicious activity while you seek a secure alternative.
Conclusion
The 'lu-anywhere' package has a critical vulnerability that allows communication with a malicious domain, posing a serious risk to applications. Developers are urged to update the package or remove it until a secure version is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for lu-anywhere →
FAQ
The vulnerability involves the package communicating with a domain linked to malicious activities, which can compromise application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Consider removing the package temporarily to mitigate risks until a secure version is available.
Yes, updating to the latest version of the 'lu-anywhere' package will address the vulnerability.
Failure to address this vulnerability could lead to data breaches, unauthorized access, and exploitation of your application.
