Malicious Code Detected in Lyft-UI Package (Version 85.8.0)
Summary
MAL-2025-190620: Malicious code in lyft-ui (npm). Affects lyft-ui versions 85.8.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lyft-UI is a user interface library designed for building web applications with a focus on providing reusable components and a consistent design language. It is widely used in the JavaScript ecosystem, particularly within projects that utilize npm for package management. However, version 85.8.0 of this package has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the Lyft-UI package arises from its communication with a domain associated with malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the application using this package. The identification of this malicious code was conducted by the OpenSSF Package Analysis project, which highlighted the risks associated with using this specific version of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lyft-uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the affected version of the Lyft-UI package from your project by running: 'npm uninstall lyft-ui'. Consider using alternative UI libraries that do not have known vulnerabilities until a secure version is released.
Conclusion
The Lyft-UI package version 85.8.0 has been identified as malicious due to its communication with a harmful domain. Users are strongly encouraged to update to a secure version or remove the package to mitigate potential risks. Tools like Vulert can assist in monitoring for vulnerabilities in your projects.
See every vulnerability recorded for lyft-ui →
FAQ
The malicious activity involves the package communicating with a domain known for harmful actions, which could compromise the security of applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not feasible, consider removing the package or using alternative libraries until a secure version is available.
Utilize tools like Vulert to monitor your package-lock.json for vulnerabilities and receive alerts in real-time.
Using older versions that are known to be vulnerable poses significant risks. It is advisable to avoid them until they are patched.
