Malicious Code Detected in @flexmr/ui: A Critical Security Concern
Summary
MAL-2026-17879: Malicious code in @flexmr/ui (npm). Affects @flexmr/ui versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @flexmr/ui is a JavaScript library available on npm, designed for user interface components. It is commonly used in web applications to enhance user experience. However, the version 99.99.99 of this package has been found to contain malicious code that compromises user security and privacy.
Vulnerability Detail
The vulnerability arises from the execution of lifecycle scripts during the installation of @flexmr/ui@99.99.99. Specifically, the scripts 'preinstall', 'install', and 'postinstall' run a file named beacon.js, which sends sensitive information such as the package name, lifecycle event, a fixed token, and host identity details to a remote server at 177.7.60.239:48080. Additionally, it encodes the hostname in a DNS query to oob.recon.dev, probing whether the build resolves the package from the public npm registry. This behavior is indicative of malicious intent, as it can lead to data exfiltration and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @flexmr/uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the affected version of @flexmr/ui by removing it from your project and replacing it with an alternative package that provides similar functionality. You can do this by running: npm uninstall @flexmr/ui.
Conclusion
The discovery of malicious code in @flexmr/ui version 99.99.99 poses a serious threat to users and applications relying on this package. It is crucial to take immediate action by updating to a secure version or removing the package altogether. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for @flexmr/ui →
FAQ
The malicious code executes scripts that send sensitive information to a remote server, posing a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider removing the package and using an alternative until a secure version is available.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
Failure to address this vulnerability could lead to data breaches, unauthorized access to sensitive information, and compromise of your application's integrity.
