Malicious Code Vulnerability in style-class-utils Package
Summary
MAL-2026-16540: Malicious code in style-class-utils (npm). Affects style-class-utils versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The style-class-utils package is a utility library in the npm ecosystem designed to facilitate the manipulation of CSS class names in JavaScript applications. It provides developers with functions to add, remove, and toggle classes efficiently. However, this package has been identified with a serious vulnerability that allows for the execution of malicious code, potentially compromising applications that rely on it.
Vulnerability Detail
The vulnerability in the style-class-utils package stems from the inclusion of malicious code within its version 1.0.0. This code can lead to unauthorized access or manipulation of the application, posing significant security risks to users and their data. The origin of this vulnerability is linked to malicious actors who have injected harmful scripts into the package, which can be executed when the package is used in applications. This can result in data breaches, loss of user trust, and potential legal ramifications for developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall style-class-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the style-class-utils package from your project until a secure version is released. To do this, run the following command: npm uninstall style-class-utils. Consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The style-class-utils package has been compromised with malicious code, posing significant risks to applications that utilize it. Developers should take immediate action to update or remove the package to safeguard their applications and users. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for style-class-utils →
FAQ
style-class-utils is a utility library for managing CSS class names in JavaScript applications.
The vulnerability involves malicious code that can execute harmful actions within applications using the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider removing the package or using alternative libraries until a secure version is available.
The vulnerability was identified by ReversingLabs, a cybersecurity firm specializing in threat detection.
