Critical Malicious Code Vulnerability in yunxohang6 Package
Summary
MAL-2026-186: Malicious code in yunxohang6 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The yunxohang6 package is a Node.js library available through npm, typically used for various functionalities in JavaScript applications. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on. Users of this package should be aware of its potential risks and take immediate action to mitigate them.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the yunxohang6 package. This code can allow unauthorized access to the system, leading to a complete compromise of any computer running the package. The malicious code can exfiltrate sensitive information, including secrets and keys, which poses a significant risk to data integrity and confidentiality. The vulnerability was reported by Amazon Inspector and is classified under CWE-506, indicating that the product contains code that appears to be malicious in nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall yunxohang6If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if you cannot immediately remove the package, consider isolating the affected system from the network to prevent further data exfiltration. Additionally, conduct a thorough security audit to identify and mitigate any other potential threats.
Conclusion
The discovery of malicious code within the yunxohang6 package poses a serious threat to users and their systems. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for yunxohang6 →
FAQ
The yunxohang6 package is a Node.js library used in various JavaScript applications, but it has been found to contain malicious code.
If you have the yunxohang6 package installed, your system is considered compromised. You should take immediate action to remove it and secure your environment.
Rotate all secrets and keys stored on the affected system from a secure computer and monitor for any unauthorized access.
Yes, you can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
