Malicious Code Detected in uglyfi.js Package - Immediate Action Required
Summary
MAL-2025-37588: Malicious code in uglyfi.js (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uglyfi.js package is a JavaScript library commonly used in web development for minifying and obfuscating code. It aims to enhance performance by reducing file sizes and improving load times. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the uglyfi.js package stems from the inclusion of malicious code that can compromise the integrity of applications using this library. This code can lead to unauthorized access, data breaches, and potential exploitation of user data. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uglyfi.jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the uglyfi.js package altogether and consider using other minification tools such as Terser or UglifyJS, which are known to be secure.
Conclusion
The discovery of malicious code in the uglyfi.js package highlights the importance of maintaining secure dependencies in software development. Developers are urged to take immediate action to remove this package and consider alternative solutions to safeguard their applications.
See every vulnerability recorded for uglyfi.js →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data and compromise application security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including those in uglyfi.js.
It is recommended to remove the uglyfi.js package immediately and replace it with a secure alternative to prevent any security breaches.
Yes, tools like Vulert can automate the detection of vulnerabilities in your dependencies without requiring access to your code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by vulnerabilities without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for uglyfi.js.
