Malicious Code Detected in ts-browser-webpack: A Critical Security Concern
Summary
MAL-2025-6132: Malicious code in ts-browser-webpack (npm). Affects ts-browser-webpack versions >= 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ts-browser-webpack' package is a tool designed for bundling TypeScript applications for use in web browsers. It streamlines the development process by allowing developers to compile TypeScript into JavaScript and manage dependencies effectively. However, this package has been flagged for communicating with a domain associated with malicious activity, raising significant security concerns for users.
Vulnerability Detail
The vulnerability in 'ts-browser-webpack' stems from its communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications utilizing this package. The issue was introduced in version 99.99.99, making it critical for users to be aware of the risks associated with this version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ts-browser-webpackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the 'ts-browser-webpack' package from your project until a secure version is available. You can do this by running: 'npm uninstall ts-browser-webpack'. Additionally, monitor your application for any suspicious activity.
Conclusion
The 'ts-browser-webpack' package has been identified as having a critical vulnerability due to its communication with a malicious domain. Users are urged to update the package to a secure version or remove it from their projects to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ts-browser-webpack →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, posing risks to application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json. Visit Vulert Scanner to check your application without signing up.
Consider removing the package from your project and monitoring for any suspicious activity until a secure version is available.
You can update the package by running 'npm update ts-browser-webpack' in your terminal, ensuring you have the latest secure version.
Detailed information can be found in the vulnerability report on GitHub at https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-browser-webpack/MAL-2025-6132.json.
