Malicious Code Detected in @corp-front/corporate-filter-company-select: Version 2.99.99
Summary
MAL-2026-461: Malicious code in @corp-front/corporate-filter-company-select (npm). Affects @corp-front/corporate-filter-company-select versions 2.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @corp-front/corporate-filter-company-select is an npm library designed to facilitate the selection of corporate filters in front-end applications. It is widely used for its ease of integration and functionality in corporate environments. However, version 2.99.99 has been flagged for containing malicious code that compromises the integrity of applications utilizing it.
Vulnerability Detail
The vulnerability in @corp-front/corporate-filter-company-select arises from its communication with a domain linked to malicious activities and the execution of commands that are harmful. This could lead to unauthorized access, data breaches, or the execution of further malicious actions within the affected systems. The origin of this vulnerability was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @corp-front/corporate-filter-company-selectIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the package from your project until a secure version is released. This can be done using the command: npm uninstall @corp-front/corporate-filter-company-select. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @corp-front/corporate-filter-company-select package version 2.99.99 has been identified as malicious, posing significant risks to applications that utilize it. It is crucial to update to a secure version or remove the package to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @corp-front/corporate-filter-company-select →
FAQ
The package communicates with a domain associated with malicious activities and executes harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, consider removing the package temporarily and using alternative solutions until a secure version is available.
The vulnerability was identified by the OpenSSF Package Analysis project, which conducts thorough assessments of open-source packages.
Yes, continuing to use the affected package poses a risk of unauthorized access and potential data breaches, which could lead to data loss.
