Malicious Code Vulnerability in @emerald-react/badge Package
Summary
MAL-2026-1599: Malicious code in @emerald-react/badge (npm). Affects @emerald-react/badge versions 999.999.999 – 9999.9999.9999. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @emerald-react/badge package is a component library for React applications, providing customizable badge components for displaying status or notifications. It is widely used in various web applications due to its ease of integration and flexibility. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability in the @emerald-react/badge package stems from the inclusion of malicious code that can compromise the security of applications using this package. This code may lead to unauthorized access, data leakage, or other malicious activities. The issue was reported by ReversingLabs, and it affects specific versions of the package, making it crucial for developers to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @emerald-react/badgeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @emerald-react/badge package from your project until a secure version is available. You can do this by running: npm uninstall @emerald-react/badge.
Conclusion
The @emerald-react/badge package has been identified to contain malicious code, posing a significant security risk to applications. It is essential for developers to update the package to a secure version or remove it until a fix is available. Monitoring tools like Vulert can assist in identifying vulnerabilities in your projects.
See every vulnerability recorded for @emerald-react/badge →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data within applications that use this package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider removing the @emerald-react/badge package from your project until a secure version is available.
The vulnerability was reported by ReversingLabs, a security research firm specializing in malware analysis.
While specific exploits have not been detailed, the presence of malicious code indicates a high risk of exploitation.
