Malicious Code Vulnerability in @nxt-costco-com/forge-components: Potential Security Risk
Summary
MAL-2026-1631: Malicious code in @nxt-costco-com/forge-components (npm). Affects @nxt-costco-com/forge-components versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @nxt-costco-com/forge-components is a component library used in various applications to streamline development processes. It provides reusable components that enhance user interface design and functionality. However, it has been identified to contain malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within version 9.9.9 of the @nxt-costco-com/forge-components package. This code can potentially compromise the security of applications by allowing unauthorized access or manipulation of data. The origin of this vulnerability is linked to the package's distribution through npm, where it was identified by security researchers from ReversingLabs. The ramifications of this vulnerability include data breaches, unauthorized access to sensitive information, and potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @nxt-costco-com/forge-componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @nxt-costco-com/forge-components package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall @nxt-costco-com/forge-components. Alternatively, consider using a different package that offers similar functionality without the associated risks.
Conclusion
The @nxt-costco-com/forge-components package has been identified to contain malicious code, posing a significant security risk to applications that utilize it. It is crucial to update the package to a secure version or consider alternative solutions to mitigate potential threats.
See every vulnerability recorded for @nxt-costco-com/forge-components →
FAQ
The malicious code can potentially allow unauthorized access and manipulation of application data, posing a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
As a temporary measure, consider uninstalling the package or using an alternative package that does not have known vulnerabilities.
The vulnerability was identified by security researchers from ReversingLabs.
Failure to address this vulnerability could lead to data breaches, unauthorized access to sensitive information, and exploitation by attackers.
