Skip to content

MAL-2025-46980 GHSA-vfjc-p7x3-q864

Malicious code in strip-ansi (npm)

Not rated yet npm
Severity
Not rated yet
No source has published a CVSS score yet
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
None yet
No fixed version published

Description

The package was compromised and malicious code added.


-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (3736bb5cc515b07f47ad6b5bb06c367271994c4b6606f1ddeb91a056788c34c2)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected versions

npm

PackageVulnerableFixed in
strip-ansi 1 listed versions No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

References

Timeline

  1. Published
  2. Last updated by the source

Credits: Amazon Inspector

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor