Malicious Code Detected in ugc-kit: A Critical npm Vulnerability
Summary
MAL-2025-192951: Malicious code in ugc-kit (npm). Affects ugc-kit versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ugc-kit is an npm package designed for user-generated content management. It provides functionalities for handling and processing user submissions, making it a valuable tool for developers building interactive applications. However, the package has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in ugc-kit stems from its communication with a domain linked to malicious activities and the execution of commands that are harmful. This behavior poses significant risks, including unauthorized access to user data, potential data breaches, and the compromise of the host application. The malicious nature of this package was identified by the OpenSSF Package Analysis project, which highlighted its association with harmful actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ugc-kitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the usage of ugc-kit in your application until a secure version is available. Additionally, consider implementing security measures such as input validation and monitoring for unusual activity in your application.
Conclusion
The ugc-kit package has been identified as malicious, posing significant security risks to applications that utilize it. It is crucial for developers to take immediate action by removing the affected package and exploring secure alternatives. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ugc-kit →
FAQ
ugc-kit is an npm package used for managing user-generated content in applications.
The package has been found to communicate with a domain associated with malicious activities and execute harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
It is recommended to uninstall the affected version of ugc-kit and replace it with a secure alternative.
Yes, consider implementing input validation and monitoring for unusual activity to mitigate risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
