Critical Malicious Code Vulnerability in @oku-ui/separator Package
Summary
MAL-2025-191273: Malicious code in @oku-ui/separator (npm). Affects @oku-ui/separator versions 0.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @oku-ui/separator package is a component library for building user interfaces in web applications. It provides developers with reusable UI components that enhance the functionality and aesthetics of their applications. However, this package has been compromised, making it susceptible to a severe security threat that can affect users' credentials and system integrity.
Vulnerability Detail
The vulnerability originates from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials from users and publish them to GitHub. It can also propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. Additionally, there is a risk that the worm may destroy the user's home directory, leading to significant data loss and security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @oku-ui/separatorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the @oku-ui/separator package from your project until a secure version is released. You can do this by executing the command: npm uninstall @oku-ui/separator. Additionally, monitor your system for any unauthorized access or changes.
Conclusion
The @oku-ui/separator package has been compromised by a malicious worm that poses significant security risks to users. It is essential to take immediate action by updating or uninstalling the package to protect your credentials and system integrity. Regular monitoring and using tools like Vulert can help ensure your applications remain secure.
See every vulnerability recorded for @oku-ui/separator →
FAQ
The malicious code is part of a worm that steals user credentials and can publish them to GitHub.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
If you have installed the compromised package, it is recommended to uninstall it immediately and monitor your system for any suspicious activity.
Yes, updating to a patched version of the package will address the vulnerability. Always check for the latest updates from the official repository.
Failing to address this vulnerability may lead to unauthorized access to sensitive information, data loss, and potential damage to your system.
