# Security Advisory: Forge CLI NPM dependencies

**URL:** <https://community.developer.atlassian.com/t/security-advisory-forge-cli-npm-dependencies/95342>\
**Category:** Forge Platform and Tools\
**Tags:** security\
**Created:** [September 15, 2025, 7:33am UTC](https://community.developer.atlassian.com/t/security-advisory-forge-cli-npm-dependencies/95342 "2025-09-15T07:33:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David5](https://avatars.discourse-cdn.com/v4/letter/d/839c29/32.png) [@David5](https://community.developer.atlassian.com/u/David5)\
**Post date:** [September 15, 2025, 7:33am UTC](https://community.developer.atlassian.com/t/security-advisory-forge-cli-npm-dependencies/95342/1 "2025-09-15T07:33:04Z")

</div>

Dear Marketplace Developer Community,

We are aware of recent reports regarding the compromise of several NPM packages targeting cryptocurrency wallets.

Our security team has investigated this matter and identified that two vulnerable packages - **strip-ansi** and **wrap-ansi** - were present in the dependency tree for our Forge CLI.

We found that Forge CLI does not directly depend on the affected versions. However, they may have been introduced through secondary dependencies if Forge CLI was installed during the vulnerable period.

It is important to note that the current known exploit path relies on a browser environment. While Forge CLI does not run in a browser, to eliminate the potential risk of exploit, we strongly recommend that all Forge CLI users uninstall and re-install Forge CLI using the following commands:

`npm uninstall -g @forge/cli`  
`npm install -g @forge/cli@latest`

The security and protection of our customer’s data is our top priority. We thank you for your cooperation.

---

<div class="post-metadata">

**Author:** ![tied](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@tied](https://community.developer.atlassian.com/u/tied)\
**Post date:** [September 15, 2025, 12:15pm UTC](https://community.developer.atlassian.com/t/security-advisory-forge-cli-npm-dependencies/95342/2 "2025-09-15T12:15:07Z")

</div>

Thanks for this update about these packages. I was curious after seen this in a Youtube video last week.

It would be great of also Cloud related Security Advisories would be published here: [Security at Atlassian: Vulnerabilities | Atlassian](https://www.atlassian.com/trust/data-protection/vulnerabilities)

---

<div class="post-metadata">

**Author:** ![marc](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/marc/32/39047_2.png) [@marc](https://community.developer.atlassian.com/u/marc)\
**Post date:** [September 15, 2025, 12:46pm UTC](https://community.developer.atlassian.com/t/security-advisory-forge-cli-npm-dependencies/95342/3 "2025-09-15T12:46:10Z")

</div>

Hi @David5 ,

Thanks for the heads up.

Can Atlassian also take care of the rest of the security vulnerabilities in forge-cli? This is a recurring issue where vulnerabilities are NOT addressed, see e.g.

> [@Removal of Dependency Deprecation Warnings in Forge CLI](https://community.developer.atlassian.com/t/removal-of-dependency-deprecation-warnings-in-forge-cli/93983/3):
>
> Hi @JacobTan ,
> 
> The new release of forge cli has a couple of vulnerability warnings, as had the last version. Is Atlassian going to fix this, and hopefully check for this before every release?