Malicious Code Vulnerability in @brick-v2/table Package
Summary
MAL-2026-17718: Malicious code in @brick-v2/table (npm). Affects @brick-v2/table versions 999.0.1 – 999.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @brick-v2/table package is an npm library designed to provide a simple Angular-style logger and table shim. It includes functionalities like forRoot, createLogger, and version no-ops. However, it has been found to contain malicious code that can exfiltrate sensitive information from the environment.
Vulnerability Detail
The vulnerability originates from the package's index.js file, which unconditionally loads a native addon (metrics.node) that reads sensitive environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and others. This data is then sent as JSON to a hardcoded external server (oob.s4yhii.com) over HTTP/1.0. The native code is designed to detach the exfiltration process from the host application, allowing it to continue running even after the host process exits. The package's misleading naming and versioning (999.0.2) further disguise its malicious behavior, making it appear as a legitimate telemetry tool.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @brick-v2/tableIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @brick-v2/table package from your project until you can update to the patched version. Use the following command to uninstall it: npm uninstall @brick-v2/table.
Conclusion
The @brick-v2/table package contains a serious vulnerability that allows for the exfiltration of sensitive environment variables. It is crucial to update to the patched version (999.0.3) or uninstall the package to mitigate risks. Utilizing tools like Vulert can help in monitoring and preventing such vulnerabilities in the future.
See every vulnerability recorded for @brick-v2/table →
FAQ
The malicious code is a native addon that exfiltrates sensitive environment variables to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just your package-lock.json. Visit Vulert Scanner to check your application without signing up.
As a temporary measure, you should uninstall the @brick-v2/table package until you can update to the patched version.
Failing to address this vulnerability can lead to unauthorized access to sensitive information, which may result in data breaches or compromised accounts.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
