Critical Malicious Code Vulnerability in scenes-devtools Package
Summary
MAL-2025-6195: Malicious code in scenes-devtools (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scenes-devtools package is a tool designed for enhancing the development experience in web applications, particularly those using the npm ecosystem. It provides various utilities for debugging and optimizing applications. However, this package has been found to contain malicious code that compromises the security of any system it is installed on, making it a significant threat to developers and organizations relying on it.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the scenes-devtools package. This code can lead to a complete compromise of any computer that has the package installed. The ramifications are severe, as it can expose sensitive information such as secrets and keys stored on the affected system. The malicious code can potentially allow unauthorized access and control over the system, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall scenes-devtoolsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks posed by this vulnerability other than removing the package entirely. Ensure that all sensitive information is secured and rotated as necessary.
Conclusion
The scenes-devtools package contains embedded malicious code that poses a serious threat to any system it is installed on. Immediate removal of the package and rotation of sensitive information is essential to mitigate the risks associated with this vulnerability. Users are encouraged to stay informed about updates and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for scenes-devtools →
FAQ
The scenes-devtools package is a development tool used in web applications to assist with debugging and optimization.
The malicious code can compromise your system, allowing unauthorized access and potentially exposing sensitive information.
You should immediately remove the scenes-devtools package and rotate any sensitive information stored on your system.
As of now, there is no patch available. The best course of action is to remove the package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json. You can also check your application against this vulnerability using the Vulert playground without any signup.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.