Malicious Code Vulnerability in @client-web-next/ui Package
Summary
MAL-2026-16512: Malicious code in @client-web-next/ui (npm). Affects @client-web-next/ui versions 9.999.2 – 9.999.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @client-web-next/ui package is a component library designed for building user interfaces in web applications. It provides a set of reusable UI components that enhance development efficiency and maintainability. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from malicious code embedded in versions 9.999.2 and 9.999.3 of the @client-web-next/ui package. This code could potentially allow unauthorized access or manipulation of application data, leading to severe consequences such as data breaches or system compromise. The origin of this malicious code is linked to a malicious package upload, which has been documented by security researchers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @client-web-next/uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the affected package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall @client-web-next/ui. This will prevent any potential exploitation of the vulnerability while you await a fix.
Conclusion
The discovery of malicious code in the @client-web-next/ui package highlights the importance of maintaining secure dependencies in software development. By promptly updating to a secure version and utilizing tools like Vulert, developers can protect their applications from potential threats.
See every vulnerability recorded for @client-web-next/ui →
FAQ
Versions 9.999.2 and 9.999.3 of the @client-web-next/ui package are known to contain malicious code.
You can use Vulert to monitor and alert for vulnerabilities in your application. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If immediate updates are not feasible, consider removing the package as a temporary measure to mitigate risks until a secure version is available.
Detailed information about the vulnerability can be found in the security advisories and the official GitHub repository of the @client-web-next/ui package.
Yes, you can use tools like Vulert, which allows you to monitor your dependencies for vulnerabilities in real-time without requiring code access or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
