Malicious Code Detected in resto_ui_components Package - Version 99.99.2
Summary
MAL-2026-197: Malicious code in resto_ui_components (npm). Affects resto_ui_components versions 99.99.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'resto_ui_components' package is a component library used in web development, primarily within the npm ecosystem. It provides a set of UI components that developers can utilize to build user interfaces efficiently. However, version 99.99.2 of this package has been identified as malicious, executing commands that may compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability in 'resto_ui_components' arises from the execution of one or more commands associated with malicious behavior. This can lead to unauthorized access, data breaches, or the execution of harmful scripts within the applications that depend on this package. The issue was identified by the OpenSSF Package Analysis project, which flagged the package due to its malicious nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall resto_ui_componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'resto_ui_components' package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall resto_ui_components.
Conclusion
The 'resto_ui_components' package version 99.99.2 has been flagged for malicious behavior, posing a significant risk to applications that utilize it. Users are advised to update the package to a secure version or remove it until a fix is available. Regular monitoring and security practices are essential to mitigate potential threats.
See every vulnerability recorded for resto_ui_components →
FAQ
The package executes commands that can lead to unauthorized access or harmful actions within applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Yes, you can uninstall the affected package as a temporary workaround until a secure version is available.
Consider reviewing your application's security measures and monitoring for any suspicious activity until you can apply the update.
Detailed information can be found in the OpenSSF Package Analysis report and the package's repository on GitHub.
