Malicious Code Vulnerability in @brick-v2/core: Exposing Sensitive Credentials
Summary
MAL-2026-17715: Malicious code in @brick-v2/core (npm). Affects @brick-v2/core versions 999.0.1 – 999.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @brick-v2/core package is a Node.js library designed to provide core functionalities for applications within the @brick-v2 scope. It is published on npm and is intended for use in various JavaScript projects. However, this package has been identified to contain malicious code that executes native binaries, posing a significant security risk by exposing sensitive environment variables.
Vulnerability Detail
The vulnerability originates from the package's main entry file, index.js, which loads a prebuilt native binary located at prebuilds/<platform>-<arch>/metrics.node. This binary executes as soon as the module is required, reading sensitive environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and others. It then sends this information to a hardcoded external server, oob.s4yhii.com, via a raw socket. This behavior is indicative of a dependency-confusion attack, where a public package is designed to override an internal package, leading to potential data breaches and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @brick-v2/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @brick-v2/core package from your project until a secure version is confirmed. Additionally, review your environment variables and ensure that sensitive information is not exposed in your application.
Conclusion
The @brick-v2/core package contains a serious vulnerability that exposes sensitive environment variables through malicious code. It is essential to update to the patched version and monitor your applications for any signs of compromise. Utilizing tools like Vulert can help maintain the security of your open-source dependencies.
See every vulnerability recorded for @brick-v2/core →
FAQ
The malicious code executes a native binary that reads sensitive environment variables and sends them to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Consider removing the package from your project and reviewing your environment variables to prevent exposure of sensitive information.
Yes, version 999.0.2 is the patched version that addresses the vulnerability. Always ensure to update to the latest version.
The vulnerability can lead to unauthorized access to sensitive credentials, which may result in data breaches and compromised accounts.
