Malicious Code Detected in eslint-plugin-fuel-react: Version 1.0.1 Vulnerability
Summary
MAL-2026-323: Malicious code in eslint-plugin-fuel-react (npm). Affects eslint-plugin-fuel-react versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eslint-plugin-fuel-react is an npm package designed to provide linting capabilities for React applications, ensuring code quality and adherence to best practices. However, version 1.0.1 of this package has been identified as malicious, posing significant risks to users by potentially executing harmful commands and communicating with malicious domains.
Vulnerability Detail
The vulnerability in eslint-plugin-fuel-react arises from its malicious behavior, which includes communicating with a domain linked to malicious activities and executing commands that can compromise the security of the host system. This behavior can lead to unauthorized access, data breaches, and the execution of harmful scripts, making it critical for users to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eslint-plugin-fuel-reactIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using eslint-plugin-fuel-react altogether until a patched version is released. Consider using alternative linting packages that do not exhibit malicious behavior.
Conclusion
The discovery of malicious code in eslint-plugin-fuel-react version 1.0.1 highlights the importance of vigilance in managing open-source packages. Users are encouraged to remove the affected package and monitor for updates while considering alternative solutions to maintain code quality without compromising security.
See every vulnerability recorded for eslint-plugin-fuel-react →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
Currently, there is no patched version available for eslint-plugin-fuel-react. Users are advised to uninstall the package until a safe version is released.
Failure to address this vulnerability can lead to unauthorized access, data breaches, and execution of harmful scripts, putting your application and data at risk.
Immediately uninstall eslint-plugin-fuel-react version 1.0.1 and consider using alternative linting packages until a safe version is available.
