Malicious Code Vulnerability in @emerald-react/datepicker: A Critical Security Concern
Summary
MAL-2026-1606: Malicious code in @emerald-react/datepicker (npm). Affects @emerald-react/datepicker versions 999.999.999 – 9999.9999.9999. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @emerald-react/datepicker package is a popular date picker component for React applications, designed to provide a user-friendly interface for selecting dates. It is widely used in various web applications due to its ease of integration and customizable features. However, recent findings have revealed that this package is susceptible to malicious code injection, posing significant security risks to applications that rely on it.
Vulnerability Detail
The vulnerability in @emerald-react/datepicker stems from the inclusion of malicious code that can compromise the integrity of applications using this package. This code may lead to unauthorized access, data breaches, or other malicious activities. The origin of this vulnerability is linked to specific versions of the package that have been identified as containing harmful code. Developers using these versions are at risk of exploitation, which could result in severe consequences for their applications and users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @emerald-react/datepickerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @emerald-react/datepicker package from your project until a secure version is available. Alternatively, you can implement a custom date picker solution that does not rely on this vulnerable package.
Conclusion
The discovery of malicious code in the @emerald-react/datepicker package highlights the importance of maintaining up-to-date dependencies in software development. By promptly addressing this vulnerability through updates or workarounds, developers can protect their applications and users from potential threats.
See every vulnerability recorded for @emerald-react/datepicker →
FAQ
The malicious code can lead to unauthorized access and potential data breaches in applications using the affected package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signing up.
The affected versions include '999.999.999' and '9999.9999.9999'. It is crucial to avoid using these versions.
Yes, updating to the latest version of @emerald-react/datepicker will resolve the vulnerability.
Consider removing the package or using an alternative date picker solution until a secure version is available.
