Malicious Code Detected in citrix-ui Package - Security Alert
Summary
MAL-2025-17072: Malicious code in citrix-ui (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The citrix-ui package is a JavaScript library used in web applications to provide user interface components for Citrix products. It is designed to enhance the user experience by offering various UI elements. However, recent findings have revealed that this package contains malicious code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability in the citrix-ui package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code could potentially allow unauthorized access, data exfiltration, or other harmful actions. The issue was introduced in version 0 and affects all subsequent versions, making it critical for developers to address this vulnerability promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall citrix-uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the citrix-ui package from your project until a secure version is released. You can do this by running: 'npm uninstall citrix-ui'. Alternatively, you may explore other UI component libraries that do not have known vulnerabilities.
Conclusion
The discovery of malicious code in the citrix-ui package poses a serious threat to applications using this library. Developers are urged to take immediate action by updating or removing the package to safeguard their applications. Stay informed about updates and consider using tools like Vulert for real-time vulnerability monitoring.
See every vulnerability recorded for citrix-ui →
FAQ
The citrix-ui package is a JavaScript library that provides user interface components for Citrix applications, enhancing user experience.
The malicious code found in the citrix-ui package can lead to unauthorized access and data exfiltration, posing a significant security threat.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As of now, there is no patched version available. It is crucial to monitor the package repository for updates.
If immediate removal is not possible, consider implementing additional security measures and monitoring your application closely for any suspicious activity.
