Critical Malicious Code Vulnerability in @brick-v2/brand Package
Summary
MAL-2026-17714: Malicious code in @brick-v2/brand (npm). Affects @brick-v2/brand versions 999.0.1 – 999.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @brick-v2/brand package is an npm library that is part of a scoped package ecosystem. It is designed to provide specific functionalities, but it has been found to contain malicious code that compromises user security. This vulnerability allows attackers to exfiltrate sensitive information from the environment, making it critical for users to be aware of its implications.
Vulnerability Detail
The vulnerability originates from a preinstall hook defined in the package's package.json file, which executes a native addon that reads sensitive environment variables (such as AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and others) and system identifiers. This information is serialized into a JSON payload and sent to a hardcoded external server (oob.s4yhii.com) via a raw TCP socket. The malicious behavior is embedded in the native binary, making it difficult to detect through standard JavaScript inspection. The package version 999.0.3 is particularly affected, and the malicious code is consistent with dependency confusion tactics.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @brick-v2/brandIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @brick-v2/brand package from your dependencies until a secure version is released. Use the following command to uninstall the package: npm uninstall @brick-v2/brand.
Conclusion
The @brick-v2/brand package has a critical vulnerability that allows for the exfiltration of sensitive information. Users must take immediate action to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help in monitoring and addressing such vulnerabilities effectively.
See every vulnerability recorded for @brick-v2/brand →
FAQ
The malicious code captures sensitive environment variables and system identifiers, sending them to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update the package, consider removing it from your project until a secure version is available.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in real-time.
Using compromised packages can lead to data breaches, loss of sensitive information, and potential exploitation of your application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
