Malicious Code Detected in @azix058/design-system: Version 10.0.0 Compromised
Summary
MAL-2025-6871: Malicious code in @azix058/design-system (npm). Affects @azix058/design-system versions 10.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @azix058/design-system is an npm library designed for creating user interface components and design systems. It provides developers with reusable components to streamline the development process. However, version 10.0.0 has been flagged for containing malicious code that compromises its integrity and security.
Vulnerability Detail
The vulnerability in @azix058/design-system arises from its communication with a domain linked to malicious activities. This package executes commands that can lead to unauthorized access or control over the user's environment. The malicious behavior poses significant risks, including data theft, system compromise, and potential exploitation of other connected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @azix058/design-systemIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the affected package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall @azix058/design-system.
Conclusion
The @azix058/design-system package version 10.0.0 has been identified as malicious due to its harmful behavior. It is essential to update to a secure version or remove the package to protect your application from potential threats. Continuous monitoring with tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for @azix058/design-system →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider removing the package from your project until a secure version is available.
Yes, using tools like Vulert allows you to monitor your project for vulnerabilities in real-time by analyzing your package-lock.json.
Using the compromised version can lead to unauthorized access, data breaches, and exploitation of your system, posing significant security risks.
