Malicious Code Detected in @client-web-next/event-bus-listener Package
Summary
MAL-2026-16500: Malicious code in @client-web-next/event-bus-listener (npm). Affects @client-web-next/event-bus-listener versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @client-web-next/event-bus-listener package is a component of the npm ecosystem designed to facilitate event-driven communication in web applications. It allows developers to listen for and respond to events, enhancing interactivity and responsiveness. However, this package has been identified as containing malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within version 0.0.1 of the @client-web-next/event-bus-listener package. This code can potentially compromise the security of applications by executing unauthorized actions or exposing sensitive data. The malicious nature of the code was identified by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @client-web-next/event-bus-listenerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the package from your project until a secure version is released. You can do this by running: npm uninstall @client-web-next/event-bus-listener.
Conclusion
The @client-web-next/event-bus-listener package has been compromised with malicious code, posing a significant risk to applications that utilize it. It is essential to take immediate action by updating or removing the package to safeguard your application from potential threats.
See every vulnerability recorded for @client-web-next/event-bus-listener →
FAQ
The malicious code can execute unauthorized actions within your application, potentially leading to data breaches or other security incidents.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Consider removing the package from your project as a temporary measure until a secure version is available.
The vulnerability was identified by ReversingLabs, a security research firm specializing in malware detection.
While specific exploits have not been detailed, the presence of malicious code indicates a high risk of exploitation.
