Malicious Code Detected in vl-ui-alert Package - npm Vulnerability
Summary
MAL-2026-989: Malicious code in vl-ui-alert (npm). Affects vl-ui-alert versions 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-alert package is a JavaScript library used in npm for creating alert components in user interfaces. It is designed to provide developers with a simple way to implement alert notifications in their applications. However, this package has been identified as containing malicious code that can execute harmful commands, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the vl-ui-alert package originates from its version 99.99.1, which has been flagged by both Amazon Inspector and the OpenSSF Package Analysis project. The malicious code embedded in this package can execute commands that may compromise the security of the application, leading to unauthorized access, data breaches, or other malicious activities. This vulnerability highlights the importance of scrutinizing third-party packages before integration into projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-alertIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, you can remove the vl-ui-alert package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall vl-ui-alert.
Conclusion
The vl-ui-alert package has been identified as containing malicious code, which poses a significant risk to applications using version 99.99.1. It is crucial to update or remove this package to safeguard your application. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vl-ui-alert →
FAQ
The vl-ui-alert package is a JavaScript library used for creating alert notifications in web applications.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By checking your package-lock.json file, Vulert can alert you to any vulnerabilities, including those in vl-ui-alert.
Using this version poses risks such as unauthorized access and potential data breaches due to the execution of malicious commands.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider removing the package from your project as a temporary measure to mitigate risks.
