Critical Malicious Code Vulnerability in uxproject11: Exfiltration of Sensitive System Information
Summary
MAL-2026-1234: Malicious code in uxproject11 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
uxproject11 is an npm package designed for user experience projects, providing various tools and functionalities to enhance web applications. However, it has been identified with a severe vulnerability that allows malicious actors to collect and exfiltrate sensitive system information to suspicious domains, posing a significant risk to users and their data.
Vulnerability Detail
The vulnerability in uxproject11 originates from malicious code embedded within the package. This code is capable of collecting sensitive system information and sending it to unauthorized external domains. The presence of high entropy files and extension mismatches further indicates the malicious nature of this code. Multiple YARA rules have been triggered, confirming the package's compromise. Users of this package are at risk of data breaches and unauthorized access to their systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uxproject11If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the uxproject11 package from their project until a secure version is released. This can be done using the command: 'npm uninstall uxproject11'. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The uxproject11 package has been found to contain malicious code that poses a significant risk to users by exfiltrating sensitive information. It is crucial for users to update or remove the package immediately to mitigate potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for uxproject11 →
FAQ
The vulnerability involves malicious code that collects and exfiltrates sensitive system information to unauthorized domains.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, you can uninstall the uxproject11 package and look for alternative solutions until a secure version is available.
Look for unusual network activity, unexpected data transmissions, or any alerts from security software that may indicate a breach.
The vulnerability was identified by SafeDep, a security research organization focused on finding and reporting malicious packages.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
