Critical Malicious Code Vulnerability in @schedaero/react-core Package
Summary
MAL-2026-1230: Malicious code in @schedaero/react-core (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @schedaero/react-core package is a JavaScript library designed for building user interfaces in React applications. It provides various components and utilities that streamline the development process. However, recent findings have revealed that this package contains malicious code, making it a significant security risk for developers using it in their projects.
Vulnerability Detail
The vulnerability stems from multiple suspicious behaviors identified within the @schedaero/react-core package. These include the presence of a suspicious URL, potential data exfiltration, process termination, and the inclusion of a preinstall script. Such behaviors can lead to unauthorized access to sensitive data and compromise the integrity of applications utilizing this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @schedaero/react-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the @schedaero/react-core package from your project until a secure version is confirmed. You can do this by running the command: npm uninstall @schedaero/react-core.
Conclusion
The discovery of malicious code within the @schedaero/react-core package highlights the importance of regular security audits and updates for open-source dependencies. Developers are urged to take immediate action to secure their applications by updating or removing the affected package.
See every vulnerability recorded for @schedaero/react-core →
FAQ
The malicious code exhibits behaviors such as data exfiltration and unauthorized process termination, posing a risk to application security.
You can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
If immediate updates are not feasible, consider removing the package from your project as a temporary measure to mitigate risks.
While specific exploits have not been publicly disclosed, the identified behaviors suggest a high risk of exploitation.
Vulert monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, providing real-time insights into potential risks.
