Malicious Code Detected in vl-ui-body Package - Security Alert
Summary
MAL-2026-990: Malicious code in vl-ui-body (npm). Affects vl-ui-body versions 10.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-body package is a component used in various web applications, primarily for managing UI elements. It is part of the npm ecosystem, which allows developers to easily integrate and manage JavaScript libraries. However, this package has been identified as containing malicious code that can execute harmful commands, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the vl-ui-body package arises from the presence of malicious code that executes harmful commands when the package is used. This issue was identified by both Amazon Inspector and the OpenSSF Package Analysis project, which flagged version 10.1.1 of the package as malicious. The ramifications of this vulnerability can include unauthorized access to system resources, data breaches, and potential exploitation of the affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-bodyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the vl-ui-body package from your project if it is not essential. This can be done using the following command: npm uninstall vl-ui-body. Alternatively, consider replacing it with a different package that offers similar functionality without the associated risks.
Conclusion
The vl-ui-body package has been flagged for containing malicious code that poses significant security risks. It is essential to update or remove this package to protect your applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for vl-ui-body →
FAQ
The vl-ui-body package is a JavaScript library used for managing UI components in web applications, part of the npm ecosystem.
The malicious code was detected by security tools such as Amazon Inspector and the OpenSSF Package Analysis project, which analyze packages for vulnerabilities.
Using the compromised version can lead to unauthorized access, data breaches, and exploitation of your application, potentially harming users and systems.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
