Malicious Code Execution in @osl-design/react Package
Summary
MAL-2026-17155: Malicious code in @osl-design/react (npm). Affects @osl-design/react versions 9.9.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @osl-design/react package is an npm module that is purportedly designed for use in React applications, likely providing components or utilities for building user interfaces. However, it has been identified as containing malicious code that executes upon installation, potentially compromising user data and system integrity.
Vulnerability Detail
The vulnerability originates from the package's installation script, which is defined in its package.json file. When a user runs 'npm install', the script automatically executes, leading to the loading of a malicious JavaScript file. This file collects sensitive information such as the OS username, hostname, and current working directory, and sends this data to an attacker-controlled DNS server. The malicious behavior is obfuscated to evade detection, making it a significant security risk for users who install this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @osl-design/reactIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid installing the @osl-design/react package altogether. If you have already installed it, ensure to uninstall it immediately and monitor your system for any unusual activity. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @osl-design/react package contains a serious vulnerability that allows for the execution of malicious code upon installation. Users are strongly advised to uninstall this package and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for @osl-design/react →
FAQ
The malicious code collects sensitive information from the user's system and sends it to an external DNS server controlled by an attacker.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Immediately uninstall the package using 'npm uninstall @osl-design/react' and monitor your system for any unusual behavior.
Yes, consider using other well-known and trusted React packages that provide similar functionality without the security risks.
The code is obfuscated and uses indirect methods to load modules, making it difficult for static analysis tools to identify its malicious behavior.
