Malicious Code Vulnerability in @user-interface-common/common-styles: Dependency Confusion Attack
Summary
MAL-2026-17874: Malicious code in @user-interface-common/common-styles (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @user-interface-common/common-styles is part of the npm ecosystem, typically used for common styling in user interface components. It is designed to provide reusable styles for web applications. However, this package has been compromised through a dependency confusion attack, where a malicious actor published a package that mimics the name of an internal package, leading to potential security risks for users who may inadvertently install it.
Vulnerability Detail
The vulnerability arises from a malicious package published by the npm user 'conx3993' as part of a dependency confusion campaign. This package, version 66.1.6, is designed to be picked up by misconfigured package resolvers over the legitimate internal package. Upon installation, a 'preinstall' hook executes a script that sends the victim's public IP address to an attacker-controlled server (realwbx.com) with a hard-coded authorization token. This exposes sensitive information about the user's environment and can lead to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @user-interface-common/common-stylesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the @user-interface-common/common-styles package until the issue is resolved. Additionally, ensure that your package manager is configured to prioritize internal packages over external ones to prevent accidental installations of malicious packages.
Conclusion
The @user-interface-common/common-styles package has been compromised through a dependency confusion attack, leading to the potential exposure of sensitive information. It is essential to uninstall the malicious package and monitor your dependencies closely to maintain security.
See every vulnerability recorded for @user-interface-common/common-styles →
FAQ
A dependency confusion attack occurs when a malicious package is published to a public repository with the same name as an internal package, tricking package managers into installing the malicious version instead of the legitimate one.
You can check if your project is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
If you have installed the malicious package, immediately uninstall it using 'npm uninstall @user-interface-common/common-styles' and check your project for any other vulnerabilities.
To prevent similar vulnerabilities, ensure that your package manager is configured to prioritize internal packages, regularly audit your dependencies, and use tools like Vulert to monitor for vulnerabilities.
Yes, vulnerabilities can be reported to the package maintainers and through platforms like GitHub or the npm registry to alert others about the issue.
