Malicious Code Injection in @mntv-analysis/ui-components: Dependency Confusion Vulnerability
Summary
MAL-2026-17870: Malicious code in @mntv-analysis/ui-components (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @mntv-analysis/ui-components is an npm library that is intended for use in various web applications. It is designed to provide UI components for developers, facilitating the creation of user interfaces. However, this package has been compromised through a dependency confusion attack, where a malicious actor published a package that masquerades as an internal library, leading to potential exploitation by unsuspecting users.
Vulnerability Detail
The vulnerability arises from a malicious package published by npm user 'conx3993' as part of a dependency confusion campaign. This package uses a name that resembles an internal package and a version number (50.1.1) that may cause misconfigured package resolvers to prioritize it over the legitimate package. Upon installation, a 'preinstall' hook executes a script (index.js) that sends a GET request to an attacker-controlled domain (realwbx.com), revealing the victim's public IP address and the name of the internal package they intended to install. This poses significant privacy and security risks, as it allows the attacker to track installations and potentially exploit the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @mntv-analysis/ui-componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the malicious package by using npm's package-lock.json file to lock your dependencies to known safe versions. Additionally, consider using a tool like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without needing to sign up.
Conclusion
The @mntv-analysis/ui-components package has been compromised through a dependency confusion attack, leading to the potential exposure of user IP addresses and internal package names. It is essential for developers to take immediate action by uninstalling the malicious package and using tools like Vulert to monitor for vulnerabilities in their projects.
See every vulnerability recorded for @mntv-analysis/ui-components →
FAQ
Dependency confusion occurs when a malicious package is published with the same name as an internal package, causing package managers to mistakenly prioritize the malicious version.
You can use tools like Vulert to scan your package-lock.json file for vulnerabilities and determine if your project is affected by this malicious package.
Immediately uninstall the package using 'npm uninstall @mntv-analysis/ui-components' and check for any other dependencies that may be compromised.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and ensure your package managers are configured correctly to avoid dependency confusion.
There is no patched version of the @mntv-analysis/ui-components package available. It is recommended to uninstall the compromised package and seek alternatives.
