Critical Malicious Code Vulnerability in preset-classic Package
Summary
MAL-2025-6246: Malicious code in preset-classic (npm). Affects preset-classic versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The preset-classic package is an npm library designed to provide a set of pre-configured settings for various JavaScript projects. It is widely used for streamlining development processes and enhancing productivity. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on, making it a significant threat to developers and organizations relying on it.
Vulnerability Detail
The vulnerability in the preset-classic package stems from the presence of embedded malicious code, which can lead to complete system compromise. This code can exfiltrate sensitive information, manipulate system processes, and potentially allow unauthorized access to the affected machine. The origin of this vulnerability is linked to the package's malicious intent, as indicated by its classification in the Open Source Vulnerability database. Users who have this package installed should consider their systems fully compromised and take immediate action to mitigate the risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall preset-classicIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the only effective workaround is to completely uninstall the preset-classic package from your system. Ensure that you rotate any secrets or keys that may have been compromised due to the installation of this package.
Conclusion
The preset-classic package contains malicious code that poses a severe threat to any system it is installed on. Immediate action is required to uninstall the package and secure any compromised information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for preset-classic →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Keeping the package installed poses significant risks, including unauthorized access to your system and potential data breaches.
Regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
Rotating secrets is crucial to prevent unauthorized access to your systems and to mitigate the impact of any potential data breaches.
