Critical Security Breach in @huntersofbook/ui: Malicious Code Injection
Summary
MAL-2025-191233: Malicious code in @huntersofbook/ui (npm). Affects @huntersofbook/ui versions 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @huntersofbook/ui package is a JavaScript library used in web development, particularly for building user interfaces. It provides various UI components that enhance the functionality and aesthetics of applications. However, this package has been compromised, making it vulnerable to severe security threats, including unauthorized access to sensitive user information.
Vulnerability Detail
The vulnerability originates from a malicious NPM worm known as Sha1-Hulud: The Second Coming. This worm injects malicious code into the @huntersofbook/ui package, which can steal user tokens and credentials, publishing them to GitHub. Additionally, it has the potential to propagate itself to other NPM packages owned by the user and can establish persistence through GitHub actions. The worm may also lead to the destruction of the user's home directory, posing a significant risk to data integrity and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @huntersofbook/uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the @huntersofbook/ui package from your project until a secure version is released. You can do this by executing: npm uninstall @huntersofbook/ui. Additionally, monitor your project for any unauthorized changes or suspicious activity.
Conclusion
The @huntersofbook/ui package has been compromised by a malicious NPM worm, posing significant risks to users and their data. It is crucial to take immediate action by updating or removing the package and monitoring for any unauthorized activity. Utilizing tools like Vulert can help maintain the security of your open-source dependencies.
See every vulnerability recorded for @huntersofbook/ui →
FAQ
The vulnerability involves malicious code that can steal sensitive information and propagate itself to other packages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Immediately uninstall the package and monitor your project for any unauthorized changes. Update to a patched version as soon as it is available.
Yes, the malicious code can propagate to other NPM packages that you own, increasing the risk of widespread compromise.
Regularly monitor your dependencies for vulnerabilities, use tools like Vulert for real-time alerts, and ensure to keep your packages updated.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
