Malicious Code Detected in tutorial_front Package - Version 90.24.24
Summary
MAL-2025-5755: Malicious code in tutorial_front (npm). Affects tutorial_front versions >= 90.24.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tutorial_front package is an npm library designed for front-end development, providing various functionalities to enhance user interfaces. However, version 90.24.24 has been identified as malicious due to its communication with a domain linked to harmful activities, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the tutorial_front package arises from its ability to communicate with a domain associated with malicious activity. This could lead to data breaches, unauthorized access, or the execution of harmful code within applications that depend on this package. The issue was identified by the OpenSSF Package Analysis project, which flagged the specific version 90.24.24 as malicious due to its behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tutorial_frontIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the tutorial_front package from your project until a secure version is released. You can do this by running the command: npm uninstall tutorial_front.
Conclusion
The tutorial_front package version 90.24.24 has been flagged as malicious due to its communication with a harmful domain. It is crucial for developers using this package to update to a secure version or remove it from their projects to protect their applications from potential threats.
See every vulnerability recorded for tutorial_front →
FAQ
tutorial_front is an npm package used for front-end development, offering various tools and functionalities for building user interfaces.
A malicious package is one that engages in harmful activities, such as communicating with dangerous domains or executing unauthorized code, potentially compromising the security of applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package right away, consider removing it from your project as a temporary measure to mitigate the risk until a secure version is available.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis report and on the GitHub repository for malicious packages.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
