Malicious Code Vulnerability in rgx33-flex-layout-core Package
Summary
MAL-2026-17521: Malicious code in rgx33-flex-layout-core (npm). Affects rgx33-flex-layout-core versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rgx33-flex-layout-core package is an npm library designed to provide flexbox layout utilities for web development. It is commonly used in various projects to simplify the creation of responsive layouts. However, this package has been compromised, leading to a significant security vulnerability that could expose users to malicious activities.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the rgx33-flex-layout-core package. This code impersonates internal Wix thunderbolt registry packages and targets Wix build pipelines through dependency confusion. Upon being required, the malicious script executes system commands to gather sensitive information such as hostname, process ID, Node.js version, and platform. This data is then sent to an attacker-controlled domain and a webhook collector, posing a serious risk to the security and integrity of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rgx33-flex-layout-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the rgx33-flex-layout-core package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall rgx33-flex-layout-core.
Conclusion
The rgx33-flex-layout-core package has been compromised with malicious code that poses a significant security risk. It is crucial to update or remove the package to protect your application from potential threats. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for rgx33-flex-layout-core →
FAQ
It is an npm package that provides utilities for creating flexbox layouts in web applications.
The malicious code can exfiltrate sensitive information from your system, potentially leading to unauthorized access or data breaches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Consider removing the package as a temporary measure until a secure version is available.
Detailed information can be found in the vulnerability report and the package's repository on npm.
