Critical Malicious Code Vulnerability in typescript-urql Package
Summary
MAL-2026-1337: Malicious code in typescript-urql (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The typescript-urql package is a popular library used for building GraphQL applications in TypeScript. It provides a set of tools for managing GraphQL queries and state management in a TypeScript environment. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on, making it crucial for users to be aware of this vulnerability.
Vulnerability Detail
The vulnerability originates from the presence of malicious code within the typescript-urql package, identified by the alias GHSA-g7m7-vfxq-49jh. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The implications of this vulnerability are severe, as it may lead to data breaches and loss of control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall typescript-urqlIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Users should ensure that they do not use any functionality provided by the typescript-urql package until it has been confirmed safe.
Conclusion
The typescript-urql package has been identified as containing malicious code that poses a significant security risk. Users are advised to uninstall the package immediately and take necessary precautions to secure their systems. Continuous monitoring for vulnerabilities is recommended to maintain the integrity of your applications.
See every vulnerability recorded for typescript-urql →
FAQ
typescript-urql is a library for building GraphQL applications in TypeScript, providing tools for query management and state handling.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
No, there is currently no patched version of the typescript-urql package available. The only solution is to uninstall the package.
After uninstalling, rotate all secrets and keys stored on the affected computer from a secure machine to prevent unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
