Malicious Code Detected in wfui-dbd-react-ui: Version 99.9.1 Compromised
Summary
MAL-2025-191668: Malicious code in wfui-dbd-react-ui (npm). Affects wfui-dbd-react-ui versions 99.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wfui-dbd-react-ui is an npm package designed for building user interfaces in React applications. It provides various components and utilities to streamline the development process. However, version 99.9.1 of this package has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in wfui-dbd-react-ui arises from its communication with a domain linked to malicious activities and the execution of commands associated with harmful behavior. This poses significant risks, including unauthorized access to user data, potential system compromise, and exploitation of the affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wfui-dbd-react-uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the wfui-dbd-react-ui package from your project until a secure version is released. Use the following command to uninstall the package:
npm uninstall wfui-dbd-react-ui
Conclusion
The wfui-dbd-react-ui package version 99.9.1 has been identified as malicious, posing serious security risks. It is essential to update or remove the package to protect your applications from potential threats. Regular monitoring of dependencies is crucial for maintaining security.
See every vulnerability recorded for wfui-dbd-react-ui →
FAQ
wfui-dbd-react-ui is an npm package used for creating user interfaces in React applications.
A malicious package is one that contains harmful code, which can compromise the security of applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider removing the package as a temporary measure until a secure version is available.
Utilize tools like Vulert that provide real-time monitoring and alerts for open-source vulnerabilities in your software.
