MalwarePublished 28 Jul 2026Updated 4 Aug 2026

fluid-type-ui (npm) · Malicious Code

Affects fluid-type-uiSource GCVE Database

Malicious package : remove fluid-type-ui and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11136

What to do

Remove fluid-type-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfluid-type-ui	Affected =2.0.8 =2.0.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fluid-type-ui npm package version 2.0.8 contains hidden malicious code that executes arbitrary attacker-controlled commands when the package is required. This code fetches data from Ethereum JSON-RPC endpoints, decrypts it, and evaluates it, enabling persistent and dynamic command-and-control. The package masquerades as a Tailwind plugin but includes unrelated malicious functionality. Any system with this package installed should be considered fully compromised.

Impact

Systems with fluid-type-ui version 2.0.8 installed and loaded are subject to arbitrary remote code execution controlled by an attacker. This results in full system compromise, including potential theft of secrets and keys. The attacker can dynamically update the malicious payload via blockchain transactions, making the infection persistent and resistant to simple removal of the package. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately from a clean environment.

Defensive guidance

The package should be immediately removed from all affected systems. Because the malicious code executes arbitrary commands with full control, any system that had this package installed or running should be considered fully compromised. All secrets and keys stored on the system must be rotated from a different, uncompromised machine. Monitor for any signs of persistent malicious activity and consider rebuilding affected systems from known good backups.

Summary

The fluid-type-ui package at version 2.0.8 includes a concealed code block hidden by a long sequence of tab characters in src/index.js. Upon requiring the module, this code queries specific Ethereum JSON-RPC endpoints for a transaction from a hardcoded Ethereum address. It extracts two IPv4 addresses from the transaction's 'to' field, performs an HTTP GET request to the first address, XOR-decrypts the response with a 16-byte key, and evaluates the decrypted code in a context that exposes require and module objects globally. This mechanism allows the attacker to execute arbitrary code on any system loading the package, with the command-and-control server address dynamically controlled via new blockchain transactions, making takedown difficult. The malicious behavior is unrelated to the package's stated purpose as a Tailwind plugin.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Aug 2026, 00:51 UTC

Technical details

References

Community reviews