Malicious Code Detected in ing-feat-ui-image Package - Critical Vulnerability Alert
Summary
MAL-2025-192950: Malicious code in ing-feat-ui-image (npm). Affects ing-feat-ui-image versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ing-feat-ui-image package is an npm library designed for image handling in web applications. It provides functionalities for image processing and manipulation, making it a popular choice among developers. However, the package has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the ing-feat-ui-image package arises from its communication with a domain linked to malicious activities and the execution of commands that can lead to harmful behavior. This poses significant risks, including unauthorized access to sensitive data, potential system compromise, and the ability to execute arbitrary code on affected systems. The package version 99.99.99 has been specifically identified as malicious by the OpenSSF Package Analysis project.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ing-feat-ui-imageIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the ing-feat-ui-image package altogether and explore other npm packages that provide similar image handling capabilities. Ensure to review the security status of any alternative packages before integrating them into your project.
Conclusion
The ing-feat-ui-image package has been identified as malicious, posing significant security risks to applications that utilize it. It is essential to take immediate action by uninstalling the package and seeking secure alternatives to protect your application from potential threats.
See every vulnerability recorded for ing-feat-ui-image →
FAQ
The ing-feat-ui-image package is an npm library used for image processing and manipulation in web applications.
It has been flagged for communicating with a domain associated with malicious activities and executing harmful commands.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
No, there is currently no patched version available for the ing-feat-ui-image package. It is recommended to uninstall it and use an alternative.
Uninstall the package immediately using npm uninstall ing-feat-ui-image and consider using a different package that is secure.
