Malicious Code Injection in mstate-angular Package
Summary
MAL-2025-47406: Malicious code in mstate-angular (npm). Affects mstate-angular versions 0.4.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mstate-angular package is a JavaScript library designed for state management in Angular applications. It provides developers with tools to manage application state effectively, enhancing the performance and maintainability of Angular applications. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability in the mstate-angular package stems from its compromise by the Shai-Hulud NPM worm. This malicious code is designed to steal tokens and credentials from users, subsequently publishing this sensitive information to GitHub. Additionally, the worm propagates itself to other NPM packages owned by the affected user, potentially leading to widespread security breaches. The malicious payload specifically targets user credentials, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mstate-angularIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the mstate-angular package from their project until they can ensure that they are using a secure version. This can be done by executing the command: 'npm uninstall mstate-angular'. However, this may affect the functionality of applications relying on this package.
Conclusion
The mstate-angular package has been compromised, leading to the introduction of malicious code that poses serious security risks. It is crucial for developers using this package to update to the latest version or remove it from their projects to protect sensitive information. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mstate-angular →
FAQ
mstate-angular is a JavaScript library for managing application state in Angular applications, providing tools for better performance and maintainability.
The package was compromised by the Shai-Hulud NPM worm, which injected malicious code into the package.
The malicious code steals user tokens and credentials, publishing them to GitHub and propagating itself to other NPM packages owned by the user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider uninstalling it temporarily to mitigate risks until a secure version is available.
