Critical Malicious Code Vulnerability in @oku-ui/toolbar Package
Summary
MAL-2025-191280: Malicious code in @oku-ui/toolbar (npm). Affects @oku-ui/toolbar versions 0.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @oku-ui/toolbar package is a JavaScript library used in web development to create customizable toolbars for user interfaces. It provides developers with a set of tools to enhance user experience through interactive elements. However, this package has been compromised, making it susceptible to a serious security threat that can affect users' credentials and system integrity.
Vulnerability Detail
The vulnerability originates from a malicious NPM worm known as Sha1-Hulud: The Second Coming. This worm injects harmful code into the @oku-ui/toolbar package, which can steal sensitive tokens and credentials from users. The malicious payload not only publishes this stolen information to GitHub but also has the potential to propagate itself to other NPM packages owned by the user. Additionally, it can establish persistence through GitHub actions and may even destroy the user's home directory, posing a significant risk to both personal and organizational data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @oku-ui/toolbarIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @oku-ui/toolbar package from your project until a secure version is released. You can do this by executing the following command: npm uninstall @oku-ui/toolbar. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @oku-ui/toolbar package has been compromised by a malicious NPM worm, posing serious security risks to users. It is essential to update the package to the latest version or remove it entirely until a secure version is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for @oku-ui/toolbar →
FAQ
The vulnerability involves malicious code that can steal user credentials and tokens, potentially leading to unauthorized access to sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If you suspect that your system has been compromised, immediately change your credentials and tokens, and remove the affected package from your project.
Regularly update your dependencies, use tools like Vulert for monitoring vulnerabilities, and review package integrity before installation.
Failing to address this vulnerability can lead to data breaches, unauthorized access to accounts, and significant damage to both personal and organizational data.
