Malicious Code Injection in @nativescript-community/ui-label: A Critical Security Threat
Summary
MAL-2025-47388: Malicious code in @nativescript-community/ui-label (npm). Affects @nativescript-community/ui-label versions 1.3.35 – 1.3.37. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nativescript-community/ui-label package is a popular library used in NativeScript applications for rendering text labels. It provides developers with customizable label components that enhance the user interface of mobile applications. However, this package has recently been compromised, exposing users to significant security risks due to the introduction of malicious code.
Vulnerability Detail
The vulnerability stems from a compromise of the @nativescript-community/ui-label package, which was infiltrated by the Shai-Hulud NPM worm. This malicious payload is designed to steal sensitive tokens and credentials from users and subsequently publish them to GitHub. Furthermore, it propagates itself to other NPM packages owned by the affected user, amplifying the potential damage. The embedded malicious code poses a severe threat to application security and user data integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @nativescript-community/ui-labelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the compromised package from their project until they can update to a secure version. This can be achieved by executing the command: npm uninstall @nativescript-community/ui-label.
Conclusion
The @nativescript-community/ui-label package has been compromised, introducing a critical vulnerability that can lead to severe security risks. It is essential for users to update to the latest version to mitigate these risks and protect their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for @nativescript-community/ui-label →
FAQ
The Shai-Hulud NPM worm is a malicious code that infiltrates NPM packages, stealing sensitive information and propagating itself to other packages owned by the user.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
Failing to address this vulnerability can lead to unauthorized access to sensitive user data, potential data breaches, and the propagation of malicious code to other packages.
Regularly updating dependencies, using tools like Vulert for monitoring vulnerabilities, and conducting security audits can help prevent future issues.
If you suspect that you have been compromised, immediately remove the affected package, update to a secure version, and review your application for any unauthorized changes or data breaches.
