Critical Vulnerability in @basic-ui-components-stc/basic-ui-components: Malicious Code Exposure
Summary
MAL-2025-47420: Malicious code in @basic-ui-components-stc/basic-ui-components (npm). Affects @basic-ui-components-stc/basic-ui-components versions 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @basic-ui-components-stc/basic-ui-components is an npm library designed for building user interface components. It provides reusable UI elements that can be integrated into web applications. However, this package has been compromised, making it susceptible to a severe security threat that can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from the package being infected by the Shai-Hulud NPM worm. This malicious payload is capable of stealing tokens and credentials from the user's environment and publishing them to GitHub. Furthermore, it can propagate itself to other NPM packages owned by the user, significantly increasing the risk of widespread compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @basic-ui-components-stc/basic-ui-componentsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should consider removing the affected package from their project until a secure version is released. You can remove the package using the following command: npm uninstall @basic-ui-components-stc/basic-ui-components.
Conclusion
The @basic-ui-components-stc/basic-ui-components package has been compromised by a malicious worm, posing significant risks to users. Immediate action is required to update or remove the package to safeguard sensitive information and prevent further exploitation.
See every vulnerability recorded for @basic-ui-components-stc/basic-ui-components →
FAQ
The Shai-Hulud NPM worm is a malicious software that infects npm packages, stealing sensitive information such as tokens and credentials.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed the compromised package, it is crucial to uninstall it immediately and monitor your environment for any unauthorized access.
The impacts include unauthorized access to sensitive information, potential data breaches, and the risk of further propagation of the malicious code to other packages.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json.
