Dependency Confusion Vulnerability in @bluewin/utils: Malicious Code Execution
Summary
MAL-2026-17437: Malicious code in @bluewin/utils (npm). Affects @bluewin/utils versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @bluewin/utils package is a utility library published on npm, designed for dependency confusion testing. It claims the @bluewin scope, which can lead to unintended installations of malicious code when a build resolves this scope from the public registry instead of a private package. This vulnerability arises from the package's postinstall script that executes potentially harmful code.
Vulnerability Detail
The vulnerability in @bluewin/utils stems from its nature as a dependency-confusion package. When installed, it runs a postinstall script that sends an HTTPS request to a Burp Collaborator endpoint, disclosing the installing host's IP address and indicating that the package was installed. Although it does not collect further data, the execution of unreviewed code with the user's privileges poses a significant security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @bluewin/utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the @bluewin/utils package and consider using alternative packages that provide similar functionality without the associated risks. You can also monitor your package dependencies using tools like Vulert to identify vulnerabilities.
Conclusion
The @bluewin/utils package poses a significant security risk due to its malicious code execution during installation. It is essential to remove this package and monitor your dependencies for vulnerabilities using tools like Vulert. Always prioritize the security of your software by verifying package sources.
See every vulnerability recorded for @bluewin/utils →
FAQ
The main issue is that it contains malicious code that executes during installation, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed @bluewin/utils, it is crucial to remove it immediately and check your system for any unauthorized access or changes.
Yes, consider using other utility libraries that do not have known vulnerabilities and are actively maintained.
Vulert uses your package-lock.json file to monitor and alert you in real-time for open-source vulnerabilities in your software.
