Critical Malicious Activity Detected in recoil-shared Package
Summary
MAL-2025-6953: Malicious code in recoil-shared (npm). Affects recoil-shared versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The recoil-shared package is a JavaScript library used in React applications for state management. It allows developers to manage shared state across components efficiently. However, this package has been identified to communicate with a domain associated with malicious activities, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the recoil-shared package arises from its communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications that depend on this package. The issue was introduced in version 1.0.0 and has been classified as a serious security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall recoil-sharedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the recoil-shared package from your project until a secure version is released. You can do this by executing: npm uninstall recoil-shared. This will prevent any potential malicious activity while you await a fix.
Conclusion
The recoil-shared package has been identified as having a serious vulnerability due to its communication with a malicious domain. It is crucial for developers using this package to take immediate action by updating or uninstalling it to protect their applications from potential threats.
See every vulnerability recorded for recoil-shared →
FAQ
Recoil-shared is a JavaScript library for state management in React applications, allowing efficient sharing of state across components.
The package communicates with a domain known for malicious activities, which could lead to data breaches or unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
It is recommended to check for the latest version of the recoil-shared package and update it to ensure you have the latest security fixes.
As a temporary measure, consider uninstalling the recoil-shared package to prevent any potential malicious activity until a secure version is available.
