Malicious Code Detected in chakra-ui-2--theme-tools Package
Summary
MAL-2026-275: Malicious code in chakra-ui-2--theme-tools (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chakra-ui-2--theme-tools package is part of the Chakra UI framework, which is designed to help developers build accessible and responsive user interfaces in React applications. This package provides tools for theming and styling components, making it easier to create visually appealing applications. However, it has recently been identified as containing malicious code, posing a significant risk to users who rely on it for their projects.
Vulnerability Detail
The vulnerability originates from the chakra-ui-2--theme-tools package, which has been found to contain malicious code. This code can potentially compromise the security of applications that utilize this package, leading to unauthorized access, data breaches, or other harmful effects. The malicious nature of the code raises concerns about the integrity of the package and the safety of applications built with it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chakra-ui-2--theme-toolsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the chakra-ui-2--theme-tools package until a secure version is released. Consider using alternative theming tools or libraries that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the chakra-ui-2--theme-tools package highlights the importance of vigilance when using open-source software. Users should take immediate action to remove the affected package and monitor their projects for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for chakra-ui-2--theme-tools →
FAQ
It is a part of the Chakra UI framework that provides tools for theming and styling React components.
The malicious code was identified through an analysis conducted by Amazon Inspector, which flagged the package for containing harmful code.
Using this package can lead to security vulnerabilities, including unauthorized access to sensitive data and potential exploitation of your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
Immediately remove the package and check for any updates or patches. Consider using alternative packages until a secure version is released.
