Critical Malicious Code Vulnerability in slack-astra-app
Summary
MAL-2025-6761: Malicious code in slack-astra-app (npm). Affects slack-astra-app versions >= 0.6.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The slack-astra-app is an npm package designed to enhance Slack functionalities, allowing users to integrate various applications and automate workflows. While it offers significant benefits in terms of productivity and collaboration, it has been found to communicate with a domain associated with malicious activity, posing a serious security risk to users and their data.
Vulnerability Detail
The vulnerability identified in slack-astra-app originates from version 0.6.3 and later, where the package engages in communication with a malicious domain. This behavior can lead to data breaches, unauthorized access to user information, and potential exploitation of the application environment. Users of this package are at risk of having their sensitive data compromised, making it imperative to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall slack-astra-appIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the slack-astra-app package from their project until a secure version is released. This can be done using the command: npm uninstall slack-astra-app. Alternatively, consider using a different package that offers similar functionalities without the associated risks.
Conclusion
The slack-astra-app package has a critical vulnerability that allows communication with a malicious domain, posing significant risks to users. It is essential to update the package to a secure version or consider alternative solutions to mitigate these risks. Staying informed and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for slack-astra-app →
FAQ
The slack-astra-app is an npm package that enhances Slack functionalities by integrating various applications and automating workflows.
The vulnerability involves the package communicating with a domain linked to malicious activities, which can lead to data breaches and unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If immediate updates are not feasible, consider uninstalling the package or using an alternative that does not pose security risks.
Regularly check for updates in your package dependencies and utilize tools like Vulert to monitor vulnerabilities in real-time.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
