Malicious Code Detected in vl-ui-accessibility Package - npm Vulnerability Alert
Summary
MAL-2026-987: Malicious code in vl-ui-accessibility (npm). Affects vl-ui-accessibility versions 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-accessibility package is a JavaScript library designed to enhance accessibility features in web applications. It aims to provide developers with tools to ensure their applications are usable by individuals with disabilities. However, the package has been identified as containing malicious code, which poses significant risks to users and their applications.
Vulnerability Detail
The vulnerability in the vl-ui-accessibility package originates from malicious code embedded within version 99.99.1. This code executes commands associated with harmful behavior, potentially compromising the security of applications that utilize this package. Users of this package may unknowingly expose their systems to various threats, including data breaches and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-accessibilityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the vl-ui-accessibility package from your project until a secure version is released. You can do this by running the following command: npm uninstall vl-ui-accessibility.
Conclusion
The vl-ui-accessibility package has been flagged for containing malicious code that can compromise application security. It is essential for users to update or uninstall the package to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vl-ui-accessibility →
FAQ
The vl-ui-accessibility package is a JavaScript library that provides tools for enhancing accessibility in web applications.
The malicious code executes commands that can lead to harmful behavior, potentially compromising the security of applications that use the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, you can temporarily uninstall the vl-ui-accessibility package until a secure version is available.
The vulnerability was reported by Amazon Inspector and identified by the OpenSSF Package Analysis project.
