Malicious Code Detected in reference-library Package: MAL-2025-6756
Summary
MAL-2025-6756: Malicious code in reference-library (npm). Affects reference-library versions >= 16.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The reference-library package is an npm library designed to provide various functionalities for developers, including reference management and data handling. It is widely used in JavaScript applications for its ease of integration and robust features. However, this package has been identified to communicate with a domain associated with malicious activity, raising significant security concerns for users relying on it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6756 originates from version 16.0.0 of the reference-library package. It allows the package to connect to a domain linked to malicious activities, potentially compromising user data and application integrity. The ramifications of this vulnerability include unauthorized access to sensitive information and the risk of further exploitation by malicious actors. Users of this package should be aware of the potential for data breaches and take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall reference-libraryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the reference-library package from your project until a secure version is available. You can uninstall it using the command: npm uninstall reference-library.
Conclusion
The reference-library package has been identified with a serious vulnerability that allows communication with a malicious domain. Users are urged to update the package or remove it from their projects to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for reference-library →
FAQ
The reference-library package is an npm library used for reference management and data handling in JavaScript applications.
This vulnerability allows the reference-library package to communicate with a domain associated with malicious activity, posing security risks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can uninstall the reference-library package to mitigate risks until a secure version is available.
Detailed information about this vulnerability can be found in the GitHub repository of the malicious packages project.
