Critical Malicious Code Vulnerability in yunxohang4 Package
Summary
MAL-2026-184: Malicious code in yunxohang4 (npm). Affects yunxohang4 versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yunxohang4 package is a Node.js module available via npm, designed for various functionalities within JavaScript applications. However, it has been identified as malicious, executing commands that compromise the security of systems where it is installed. This vulnerability poses a significant risk to users, as it can lead to unauthorized access and control over affected systems.
Vulnerability Detail
The vulnerability originates from the malicious nature of the yunxohang4 package, which executes harmful commands upon installation. This behavior can lead to a complete compromise of any system running the package, allowing attackers to access sensitive information, including secrets and keys. The OpenSSF Package Analysis project has flagged this package as malicious, indicating that it contains embedded malicious code that can severely impact system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall yunxohang4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks associated with the yunxohang4 package. The best course of action is to uninstall the package and secure your system.
Conclusion
The yunxohang4 package presents a critical security risk due to its malicious behavior. Users are strongly advised to uninstall the package and secure their systems by rotating any sensitive information. Continuous monitoring for vulnerabilities is essential to maintain system integrity.
See every vulnerability recorded for yunxohang4 →
FAQ
Yunxohang4 is a Node.js package available on npm, which has been identified as malicious due to its ability to execute harmful commands.
If you have installed the yunxohang4 package, your system is likely compromised. It is recommended to uninstall the package and rotate any sensitive information.
Immediately rotate all secrets and keys from a secure computer, as the malicious package may have exposed them.
No, there is currently no patched version available. The only solution is to uninstall the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
