Critical Malicious Code Vulnerability in ui.dist.min.js Package
Summary
MAL-2026-17460: Malicious code in ui.dist.min.js (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ui.dist.min.js package is a JavaScript library commonly used in web development for user interface components. It is designed to enhance the functionality and aesthetics of web applications. However, this package has been identified as containing malicious code that poses significant security risks to systems where it is installed.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the ui.dist.min.js package. This code can compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be harmful. Users should be aware that simply removing the package may not eliminate all traces of the malicious software, as full control of the affected computer may have been granted to an external entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ui.dist.min.jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that the ui.dist.min.js package is not used in your application until it has been verified as safe. You can also monitor your project for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file to alert you of any open-source vulnerabilities in real-time.
Conclusion
The discovery of malicious code in the ui.dist.min.js package poses a serious threat to users and their systems. Immediate action is required to mitigate risks, including removing the package and rotating sensitive information. Utilizing tools like Vulert can help monitor and prevent future vulnerabilities.
See every vulnerability recorded for ui.dist.min.js →
FAQ
Immediately remove the package and rotate any sensitive information stored on the affected machine.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability can lead to unauthorized access to sensitive data and complete compromise of the affected system.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert and keep your packages updated.
Vulert is a monitoring tool that uses your package-lock.json to alert you in real-time about open-source vulnerabilities in your software.
