Malicious Code Detected in xbox-bottomnav Package: Version 99.99.11
Summary
MAL-2025-192604: Malicious code in xbox-bottomnav (npm). Affects xbox-bottomnav versions 99.99.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xbox-bottomnav package is an npm library designed for navigation components in Xbox-related applications. It provides developers with pre-built UI elements to enhance user experience. However, the package version 99.99.11 has been flagged for malicious activity, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in the xbox-bottomnav package arises from its communication with a domain associated with malicious activities. This behavior poses significant risks, including data breaches, unauthorized access to user information, and potential exploitation of the application using this package. The malicious nature of the package was identified by the OpenSSF Package Analysis project, which monitors and assesses the security of open-source packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall xbox-bottomnavIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the xbox-bottomnav package from your project until a secure version is confirmed. Use the following command to uninstall the package: npm uninstall xbox-bottomnav. This will prevent any potential malicious activity while you assess alternative navigation solutions.
Conclusion
The xbox-bottomnav package version 99.99.11 has been identified as malicious due to its communication with harmful domains. It is crucial for developers using this package to update to a secure version or remove it from their projects to protect against potential security threats. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for xbox-bottomnav →
FAQ
xbox-bottomnav is an npm package that provides navigation components for Xbox-related applications.
A malicious package is one that contains harmful code or behavior, such as communicating with unauthorized domains or compromising user data.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package right away, consider removing it from your project as a temporary measure to mitigate risks.
Vulert uses the package-lock.json file to monitor and alert users in real-time for open-source vulnerabilities, ensuring your applications remain secure.
