Critical Malicious Code Vulnerability in @dev-blinq/ui-systems Package
Summary
MAL-2025-191214: Malicious code in @dev-blinq/ui-systems (npm). Affects @dev-blinq/ui-systems versions 1.0.93. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @dev-blinq/ui-systems package is a component of the npm ecosystem, designed to facilitate user interface development. It provides various UI systems and components for developers. However, this package has been compromised, exposing users to significant security risks due to malicious code embedded within it.
Vulnerability Detail
The vulnerability stems from a compromise by the Sha1-Hulud: The Second Coming NPM worm. This malicious payload is designed to steal tokens and credentials from users, subsequently publishing them to GitHub. The worm can propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. Additionally, it poses a risk of destroying the user's home directory, leading to severe data loss and security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @dev-blinq/ui-systemsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the compromised package until a fix is applied. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @dev-blinq/ui-systems package has been compromised by a malicious worm, posing serious security risks to users. It is crucial to update the package to a patched version and monitor for any unauthorized access to your systems. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for @dev-blinq/ui-systems →
FAQ
The malicious code is designed to steal sensitive information such as tokens and credentials, which can lead to unauthorized access to user accounts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without requiring any installation.
If you have already used the compromised package, it is essential to update to the latest patched version immediately and review your security practices to mitigate any potential breaches.
Yes, the malicious payload has the potential to destroy the user's home directory, which can lead to significant data loss and compromise the entire system.
To prevent future vulnerabilities, regularly update your packages, monitor for security advisories, and consider using tools like Vulert to stay informed about potential risks.
