Malicious npm package 'esbuild-linux-arm32' discovered — immediate audit and cleanup advised

Key update

On August 14, 2025 an npm package named esbuild-linux-arm32 was identified as containing malicious code (OSV entry MAL-2025-19818). This is not a bug in the upstream esbuild codebase but a malicious or compromised package in the npm namespace that can be pulled into projects by loose dependency graphs, mirror/proxy misconfigurations, or careless installs.

Why it matters

esbuild is embedded in many frontend toolchains (Vite, frameworks, build tools). A malicious esbuild-* binary package in your dependency graph means an attacker could execute arbitrary code during install or when the dev server/binary runs, which risks code theft, secret exfiltration, or supply-chain persistence. Practical immediate actions: check your lockfile and node_modules for any esbuild-* packages you did not expect, run npm ci (or equivalent) from a pinned lockfile rather than installing untrusted new packages, remove any esbuild-linux-arm32 package, rotate credentials that were available to the affected environment, and add package/name allowlists or package-provenance checks in CI. For teams, enforce strict lockfile usage, cache or mirror trusted packages, and add automated scans for malicious/mismatched package names.

Source

• Source