Malicious Code Vulnerability in vl-ui-contact-card Package (npm)
Summary
MAL-2026-995: Malicious code in vl-ui-contact-card (npm). Affects vl-ui-contact-card versions 10.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vl-ui-contact-card package is a JavaScript library used in web applications for managing and displaying contact information in a user-friendly card format. It is widely utilized in various npm-based projects due to its ease of integration and customizable features. However, the package version 10.1.1 has been identified as malicious, executing harmful commands that can compromise application security.
Vulnerability Detail
The vulnerability in the vl-ui-contact-card package arises from its malicious behavior, where it executes one or more commands that are associated with harmful activities. This can lead to unauthorized access, data breaches, or other security incidents. The package was flagged by the OpenSSF Package Analysis project, which detected its malicious nature, indicating a significant risk for users who have integrated this version into their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vl-ui-contact-cardIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the vl-ui-contact-card package from your project and replacing it with an alternative library that offers similar functionality without the associated risks. You can also implement additional security measures, such as monitoring your application for unusual behavior.
Conclusion
The vl-ui-contact-card package version 10.1.1 has been identified as malicious, posing significant risks to applications that utilize it. It is essential to update to a secure version or implement workarounds to mitigate potential threats. Regular monitoring and vulnerability assessments are crucial for maintaining application security.
See every vulnerability recorded for vl-ui-contact-card →
FAQ
The vl-ui-contact-card package is a JavaScript library designed for displaying and managing contact information in web applications.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged the package for executing harmful commands.
Using the compromised version can lead to unauthorized access, data breaches, and other security vulnerabilities in your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If immediate updating is not possible, consider removing the package and using an alternative library, or implement additional security measures to monitor your application.
