Malicious Code Detected in whatfix-icons Package: Version 7.0.0 Compromised
Summary
MAL-2026-1495: Malicious code in whatfix-icons (npm). Affects whatfix-icons versions 7.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The whatfix-icons package is a library used in web development, primarily for providing a collection of icons that can be easily integrated into applications. It is commonly utilized in projects that require a user-friendly interface with visual elements. However, version 7.0.0 of this package has been flagged for malicious behavior, raising concerns about its security and the integrity of applications that depend on it.
Vulnerability Detail
The vulnerability in the whatfix-icons package arises from its communication with a domain linked to malicious activities. This behavior poses significant risks, including potential data breaches, unauthorized access to user information, and the possibility of further exploitation within the application ecosystem. The identification of this malicious activity was made by the OpenSSF Package Analysis project, which highlighted the specific version 7.0.0 as compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall whatfix-iconsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the whatfix-icons package from your project temporarily until a secure version is available. You can do this by running: npm uninstall whatfix-icons. This will help mitigate the risk associated with the current version.
Conclusion
The whatfix-icons package version 7.0.0 has been identified as malicious due to its communication with a harmful domain. It is essential for developers to update or remove this package to safeguard their applications. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for whatfix-icons →
FAQ
The package has been found to communicate with a domain that is known for malicious activities, which can compromise the security of applications using it.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, it can identify if your application is affected. Visit Vulert Scanner to check without any signup.
Yes, you can revert to a previous version by specifying the version number in your npm install command, such as: npm install whatfix-icons@6.0.0.
If you cannot update the package right away, consider removing it from your project to prevent any potential security risks until a secure version is available.
Regularly check for updates on your packages and consider using tools like Vulert to monitor vulnerabilities in real-time.
