Malicious Code Vulnerability in @coopeuch/components: Data Exfiltration Risk
Summary
MAL-2026-17761: Malicious code in @coopeuch/components (npm). Affects @coopeuch/components versions 1.999.999. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @coopeuch/components package is a JavaScript library published on npm, primarily used for various component functionalities in web applications. It is designed to facilitate developers in building user interfaces efficiently. However, a critical vulnerability has been identified in version 1.999.999, where the package contains malicious code that collects sensitive information from the user's environment during installation.
Vulnerability Detail
The vulnerability originates from a postinstall script included in the package, which executes automatically upon installation. This script gathers sensitive data such as hostname, username, user IDs, home directory, platform details, network interface information, and CI/CD environment variables. The collected data is then sent to a remote server, posing a significant risk of data exfiltration. This behavior is indicative of a dependency-confusion attack, where the malicious package is designed to replace an internal package, leading to unintended disclosure of sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @coopeuch/componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @coopeuch/components package altogether until a secure version is released. If you must use it, consider isolating the installation in a controlled environment where sensitive data is not accessible.
Conclusion
The @coopeuch/components package has a critical vulnerability due to malicious code that collects and exfiltrates sensitive data upon installation. Users are advised to uninstall the package and monitor for any updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your application effectively.
See every vulnerability recorded for @coopeuch/components →
FAQ
The vulnerability involves malicious code that collects sensitive information during the installation process, which is then sent to a remote server.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you in real-time. You can also check your application using the Vulert playground without any signup.
If you have installed the @coopeuch/components package, immediately uninstall it using 'npm uninstall @coopeuch/components' and monitor for any updates or patches.
Currently, there is no patched version available for the @coopeuch/components package. It is advisable to avoid using it until a secure version is released.
The consequences include unauthorized access to sensitive information such as user credentials, network configurations, and other environment details, which can lead to further exploitation.
