Malicious Code Detected in vl-ui-checkbox Package - Version 10.1.1
Summary
MAL-2026-993: Malicious code in vl-ui-checkbox (npm). Affects vl-ui-checkbox versions 10.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-checkbox package is a popular npm library used for creating checkbox UI components in web applications. It provides developers with customizable checkbox elements that can be easily integrated into their projects. However, version 10.1.1 of this package has been identified as malicious, executing harmful commands that could compromise application security.
Vulnerability Detail
The vulnerability in the vl-ui-checkbox package arises from the execution of one or more commands associated with malicious behavior. This issue was identified by the OpenSSF Package Analysis project, which flagged version 10.1.1 as a threat. The malicious code can lead to unauthorized access, data breaches, or other harmful actions within applications that utilize this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-checkboxIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider removing the vl-ui-checkbox package from your project and replacing it with an alternative checkbox library that does not have known vulnerabilities.
Conclusion
The vl-ui-checkbox package version 10.1.1 has been flagged for malicious behavior, posing significant risks to applications that utilize it. It is crucial to update to a safe version or consider alternative libraries to ensure the security of your projects.
See every vulnerability recorded for vl-ui-checkbox →
FAQ
The vl-ui-checkbox package is an npm library designed for creating customizable checkbox UI components for web applications.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged the package for executing harmful commands.
Using the compromised version can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider removing the vl-ui-checkbox package and using a different library that does not have known vulnerabilities.
