Malicious Code Detected in linkedin-ui Package - Version 85.8.0
Summary
MAL-2025-190613: Malicious code in linkedin-ui (npm). Affects linkedin-ui versions 85.8.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linkedin-ui' package is a JavaScript library used in npm ecosystems for building user interfaces that integrate with LinkedIn services. It provides various components and functionalities that enhance the user experience when interacting with LinkedIn features. However, version 85.8.0 has been flagged for malicious activity, raising concerns about its security and integrity.
Vulnerability Detail
The vulnerability in the 'linkedin-ui' package stems from its communication with a domain that is associated with malicious activities. This could potentially lead to data breaches, unauthorized access, or other security threats to applications utilizing this package. The identification of this malicious behavior was made by the OpenSSF Package Analysis project, which scrutinizes packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall linkedin-uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the 'linkedin-ui' package from your project until a secure version is released. You can do this by running the command: 'npm uninstall linkedin-ui'. This will prevent any potential malicious activity while you seek alternatives or await a patch.
Conclusion
The 'linkedin-ui' package version 85.8.0 has been identified as malicious due to its communication with harmful domains. It is crucial for developers using this package to take immediate action by updating or removing it to safeguard their applications from potential threats.
See every vulnerability recorded for linkedin-ui →
FAQ
The 'linkedin-ui' package is a JavaScript library designed for building user interfaces that interact with LinkedIn services, providing various UI components.
A malicious package is one that contains code or behavior that can harm users or their systems, such as unauthorized data access or communication with harmful domains.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can provide real-time alerts. You can also check your application using the Vulert playground without any signup.
If immediate updates are not possible, consider removing the package temporarily as a workaround to mitigate risks until a secure version is available.
Detailed information about this vulnerability can be found in the OpenSSF Package Analysis project documentation and the package's repository.
