Malicious Code Detected in vl-ui-action-group Package - Version 10.1.1 Vulnerability
Summary
MAL-2026-988: Malicious code in vl-ui-action-group (npm). Affects vl-ui-action-group versions 10.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-action-group package is a component of the npm ecosystem, designed to facilitate the creation and management of action groups in user interfaces. It is commonly used in web applications to enhance user interaction. However, this package has been identified with a significant vulnerability that allows malicious code execution, posing a risk to applications that depend on it.
Vulnerability Detail
The vulnerability in the vl-ui-action-group package arises from the presence of malicious code that executes harmful commands. This issue was identified by both Amazon Inspector and the OpenSSF Package Analysis project, which flagged version 10.1.1 as compromised. The malicious behavior can lead to unauthorized actions within the application, potentially compromising user data and application integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-action-groupIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the vl-ui-action-group package from your project until a secure version is released. You can do this using the following command: npm uninstall vl-ui-action-group.
Conclusion
The vl-ui-action-group package version 10.1.1 has been identified as containing malicious code, posing significant risks to applications utilizing it. It is crucial to update or remove the package to safeguard your application from potential threats.
See every vulnerability recorded for vl-ui-action-group →
FAQ
vl-ui-action-group is an npm package used for managing action groups in user interfaces, enhancing user interactions in web applications.
The malicious code was detected by security tools such as Amazon Inspector and the OpenSSF Package Analysis project, which analyze packages for vulnerabilities.
The risks include unauthorized command execution, potential data breaches, and overall compromise of application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. Check your application using the Vulert playground without any signup.
If an immediate update is not possible, consider removing the vl-ui-action-group package from your project until a secure version is available.
