Malicious Code Detected in vl-ui-breadcrumb Package - Version 10.1.1
Summary
MAL-2026-991: Malicious code in vl-ui-breadcrumb (npm). Affects vl-ui-breadcrumb versions 10.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-breadcrumb package is a component used in web development, particularly for creating breadcrumb navigation in user interfaces. It is designed to enhance user experience by providing a clear path of navigation. However, version 10.1.1 has been flagged for malicious behavior, which poses significant risks to applications utilizing this package.
Vulnerability Detail
The vulnerability in the vl-ui-breadcrumb package stems from its malicious code that executes commands associated with harmful behavior. This can lead to unauthorized access, data breaches, or other malicious activities within applications that rely on this package. The OpenSSF Package Analysis project identified this issue, emphasizing the need for immediate attention from developers using this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-breadcrumbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the vl-ui-breadcrumb package from your project until a secure version is released. You can do this by running the command: npm uninstall vl-ui-breadcrumb. This will prevent the execution of any malicious code associated with the package.
Conclusion
The vl-ui-breadcrumb package version 10.1.1 has been identified as malicious, posing significant risks to applications. It is essential to update or remove this package to safeguard your application from potential threats. Regular monitoring and vulnerability checks are recommended to maintain application security.
See every vulnerability recorded for vl-ui-breadcrumb →
FAQ
vl-ui-breadcrumb is a package used for creating breadcrumb navigation in web applications, enhancing user experience.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 10.1.1 for executing harmful commands.
Using the affected version can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
