Malicious Code Detected in base-ui-vue3 Package - Security Alert
Summary
MAL-2026-270: Malicious code in base-ui-vue3 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The base-ui-vue3 package is a component library designed for building user interfaces in Vue 3 applications. It offers a range of UI components that enhance the development experience by providing pre-built elements. However, this package has been identified to contain malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability originates from the base-ui-vue3 package, which has been found to include malicious code. This code can potentially compromise the security of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. The issue was identified by Amazon Inspector, which flagged the package for containing harmful elements that could affect users and systems relying on it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall base-ui-vue3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the base-ui-vue3 package from your project and replacing it with an alternative UI component library that does not have known vulnerabilities. This can help maintain the security of your application while you assess the situation.
Conclusion
The base-ui-vue3 package has been flagged for containing malicious code, posing a significant risk to applications that utilize it. It is essential to update the package to a secure version or consider alternative solutions to safeguard your application. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for base-ui-vue3 →
FAQ
base-ui-vue3 is a UI component library for Vue 3 applications, providing developers with pre-built components to enhance user interface development.
The malicious code was detected by Amazon Inspector, which scans packages for security vulnerabilities and flags those that contain harmful elements.
Using the compromised base-ui-vue3 package can lead to unauthorized access, data breaches, and other security issues that may affect your application and its users.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including those in base-ui-vue3.
Yes, Vulert provides real-time monitoring for open-source vulnerabilities. You can check your application for vulnerabilities without requiring access to the code or installation by using the Vulert playground.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
