Critical Malicious Code Vulnerability in xc-input-toggle Package
Summary
MAL-2026-1316: Malicious code in xc-input-toggle (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xc-input-toggle package is a JavaScript library available on npm that provides functionality for toggling input elements in web applications. It is commonly used in various projects to enhance user interfaces by allowing users to switch between different input states. However, this package has been found to contain malicious code, posing significant security risks to any system that has it installed.
Vulnerability Detail
The xc-input-toggle package has been identified as containing embedded malicious code, which can compromise the security of any computer that has this package installed. This vulnerability originates from a malicious actor who has injected harmful code into the package, leading to potential unauthorized access to sensitive information, including secrets and keys stored on the affected system. The ramifications of this vulnerability are severe, as it grants full control of the computer to an outside entity, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall xc-input-toggleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the xc-input-toggle package from your system. It is essential to monitor your system for any signs of compromise after removal.
Conclusion
The xc-input-toggle package has been compromised with malicious code, posing a serious security threat to any systems using it. Immediate removal of the package and rotation of sensitive information is essential to mitigate risks. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for xc-input-toggle →
FAQ
The xc-input-toggle package is a JavaScript library used for toggling input elements in web applications, enhancing user interface functionality.
The malicious code can grant unauthorized access to sensitive information and allow external entities to control your computer.
You should immediately uninstall the xc-input-toggle package and rotate any sensitive information stored on your system.
No, there is no patched version available for the xc-input-toggle package. It is recommended to remove it entirely.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
