Malicious Code Vulnerability in @emerald-react/menu Package
Summary
MAL-2026-1615: Malicious code in @emerald-react/menu (npm). Affects @emerald-react/menu versions 999.999.999 – 9999.9999.9999. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @emerald-react/menu package is a component library for building menus in React applications. It provides developers with a set of customizable and reusable menu components that enhance user experience. However, this package has been identified to contain malicious code, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the @emerald-react/menu package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code may lead to unauthorized access, data leakage, or other harmful actions within the application. The malicious code was identified in versions 999.999.999 and 9999.9999.999, and it is crucial for developers to be aware of the potential ramifications of using these versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @emerald-react/menuIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if you cannot update the package immediately, consider removing the @emerald-react/menu package from your project until a secure version is available. This can be done using the command: npm uninstall @emerald-react/menu.
Conclusion
The @emerald-react/menu package has been found to contain malicious code that poses a serious security risk. It is essential for developers to update to the latest version or remove the package to protect their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @emerald-react/menu →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data or execute harmful actions within the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions are 999.999.999 and 9999.9999.999.
Yes, it is recommended to update to the latest stable version of the @emerald-react/menu package to mitigate the risk.
As a temporary measure, you can uninstall the @emerald-react/menu package from your project until a secure version is available.
