Malicious Code Injection in @asenfotech/unplugin-element-plus: A Critical Security Threat
Summary
MAL-2026-16318: Malicious code in @asenfotech/unplugin-element-plus (npm). Affects @asenfotech/unplugin-element-plus versions 2.9.3 – 2.9.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @asenfotech/unplugin-element-plus is designed as an Element Plus resolver for Vue tooling, providing developers with a streamlined way to integrate Element Plus components into their Vue applications. However, this package has been found to contain malicious code that poses significant security risks to users. The vulnerability stems from the package's deceptive structure, where the main functionality is overshadowed by harmful scripts that execute unauthorized actions on the user's system.
Vulnerability Detail
The vulnerability originates from a malicious code injection within the package, which includes a post-install hook that executes a dropper mechanism. This mechanism assembles and decodes base64-encoded payloads, which are then written to a hidden directory and executed in a detached node process. The payload functions as a command-and-control agent, capable of sending sensitive information such as hostname, username, and OS details to a typosquatted domain. It can also execute arbitrary commands, upload and download files, and manipulate system processes, all while evading detection. The malicious behavior is triggered both during installation and import, making it particularly insidious.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @asenfotech/unplugin-element-plusIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the @asenfotech/unplugin-element-plus package until the vulnerability is addressed. Additionally, monitoring tools such as Vulert can be employed to track vulnerabilities in real-time. Users can utilize the Vulert playground at https://vulert.com/scanner to check if their application is affected by this vulnerability without requiring any signup.
Conclusion
The discovery of malicious code within the @asenfotech/unplugin-element-plus package highlights the importance of vigilance in managing open-source dependencies. Users are strongly advised to update or remove the package and utilize monitoring tools like Vulert to safeguard their applications against potential threats.
See every vulnerability recorded for @asenfotech/unplugin-element-plus →
FAQ
The vulnerability involves malicious code that executes unauthorized commands and sends sensitive information to an external server.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without signing up.
You should update the package to the latest version or remove it entirely until a secure version is available.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, system manipulation, and potential data breaches.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert and keep your packages updated to the latest secure versions.
