Malicious Code in ua-parser-js npm Package
Summary
GHSA-pjwm-rvh2-c87w: Embedded malware in ua-parser-js. Affects ua-parser-js across 3 version ranges.
>= 0.7.29, < 0.7.30
>= 0.8.0, < 0.8.1
>= 1.0.0, < 1.0.1
Fixed in 0.7.30, 0.8.1 or 1.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ua-parser-js is an npm package used for parsing user-agent strings in JavaScript applications. It provides information about the user's browser, operating system, and device. The package is widely used in web development projects to enhance user experience and perform browser-specific optimizations. However, several versions of ua-parser-js (0.7.29, 0.8.0, 1.0.0) were found to contain embedded malware, compromising the security of systems that have this package installed.
Vulnerability Detail
The npm package ua-parser-js had three versions (0.7.29, 0.8.0, 1.0.0) published with malicious code. This means that any computer with these versions installed or running should be considered fully compromised. The malicious code can give control of the computer to an outside entity, potentially leading to unauthorized access, data theft, or further exploitation. It is crucial to upgrade to the fixed versions (0.7.30, 0.8.1, 1.0.1) immediately and check for any suspicious activity on the system.
How To Fix
Latest published version: 2.0.10 as of 22 Oct 2026
npm install ua-parser-js@2.0.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.7.29, < 0.7.300.7.30npm install ua-parser-js@0.7.30 -
>= 0.8.0, < 0.8.10.8.1npm install ua-parser-js@0.8.1 -
>= 1.0.0, < 1.0.11.0.1npm install ua-parser-js@1.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The ua-parser-js npm package has been found to contain embedded malware in versions 0.7.29, 0.8.0, and 1.0.0. It is crucial to upgrade to the fixed versions (0.7.30, 0.8.1, 1.0.1) immediately and check for any suspicious activity on the system. Rotate all secrets and keys stored on the compromised computer and consider removing the affected package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ua-parser-js →
FAQ
ua-parser-js is an npm package used for parsing user-agent strings in JavaScript applications. It provides information about the user's browser, operating system, and device.
The affected versions are 0.7.29, 0.8.0, and 1.0.0.
You can check your project's package.json or package-lock.json file to see the installed version of ua-parser-js.
The malicious code in the affected versions of ua-parser-js can give control of the compromised computer to an outside entity. This can lead to unauthorized access, data theft, or further exploitation.
As full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. It is recommended to thoroughly scan the system and take necessary security measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for ua-parser-js.
