Critical Malicious Code Vulnerability in react-redux-stylizer Package
Summary
MAL-2025-6340: Malicious code in react-redux-stylizer (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The react-redux-stylizer package is an npm library designed to enhance styling capabilities in React-Redux applications. It allows developers to create styled components with ease, integrating seamlessly into the React ecosystem. However, this package has been found to contain malicious code that compromises the security of any system it is installed on.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the react-redux-stylizer package. This code can lead to a complete compromise of any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of this code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users should be aware that simply removing the package may not eliminate all traces of the malicious software, as full control of the system may have been granted to an external entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-redux-stylizerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to avoid using the react-redux-stylizer package altogether. If you have already installed it, remove it using the following command: npm uninstall react-redux-stylizer. Additionally, rotate all secrets and keys stored on the affected system from a secure environment.
Conclusion
The react-redux-stylizer package contains embedded malicious code that poses a significant security risk. Users are urged to uninstall the package immediately and take necessary precautions to secure their systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for react-redux-stylizer →
FAQ
react-redux-stylizer is an npm package that enhances styling in React-Redux applications, allowing for easier creation of styled components.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to further security breaches.
Immediately uninstall the react-redux-stylizer package and rotate any sensitive information stored on your system.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While removing the package is essential, there is no guarantee that all malicious software will be removed. It is advisable to take additional security measures.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
