Malicious Code Detected in domino-elements Package - Security Alert
Summary
MAL-2026-478: Malicious code in domino-elements (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The domino-elements package is an npm library that provides various elements for building web applications. It is widely used due to its ease of integration and functionality. However, recent findings have revealed that this package contains malicious code, posing a significant security risk to applications that depend on it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the domino-elements package. This code can potentially compromise the security of applications using the package, leading to unauthorized access, data breaches, or other malicious activities. The issue was identified by Amazon Inspector, which flagged the package for containing harmful elements that could exploit system vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall domino-elementsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the domino-elements package from your project until a secure version is available. You can do this by executing the command: 'npm uninstall domino-elements'. Alternatively, you can explore other packages that offer similar functionality without the associated risks.
Conclusion
In summary, the domino-elements package has been flagged for containing malicious code, posing a serious security threat to applications that utilize it. It is crucial to update the package to a secure version or consider alternative solutions to mitigate risks. Regular monitoring of your dependencies is recommended to maintain application security.
See every vulnerability recorded for domino-elements →
FAQ
The domino-elements package is an npm library used for building web applications, providing various UI components and elements.
The malicious code was detected by Amazon Inspector, which scans packages for security vulnerabilities and flags those that contain harmful elements.
Using the compromised package can lead to unauthorized access, data breaches, and exploitation of application vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
