Critical Malicious Code Vulnerability in ui-base-colors Package
Summary
MAL-2026-17459: Malicious code in ui-base-colors (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ui-base-colors package is an npm library designed to provide a set of base colors for user interfaces, enabling developers to create visually appealing applications. However, it has been found to contain malicious code that compromises the security of any system where it is installed. This vulnerability poses a significant risk as it can lead to unauthorized access and control over the affected systems.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the ui-base-colors package. Any system running this package is considered fully compromised, allowing attackers to potentially access sensitive information, secrets, and keys stored on the machine. The malicious code can persist even after the package is removed, making it crucial for users to take immediate action to secure their systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ui-base-colorsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks associated with the malicious code in the ui-base-colors package. The only recommended action is to remove the package entirely.
Conclusion
The ui-base-colors package has been identified as containing malicious code that compromises system security. Immediate removal of the package and rotation of sensitive information is necessary to mitigate risks. Users are encouraged to monitor for updates and utilize tools like Vulert to stay informed about vulnerabilities in their applications.
See every vulnerability recorded for ui-base-colors →
FAQ
You should remove the ui-base-colors package immediately and rotate any sensitive information stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Keeping the package installed can lead to unauthorized access to your system, data breaches, and potential control by malicious actors.
While removing the package is essential, you should also rotate all secrets and keys stored on the compromised machine to ensure security.
If a patched version is released, updating the package may resolve the vulnerability, but immediate removal is still recommended due to the risk of residual malicious code.
