frontend-vue-next (npm) · Malicious Code
Affects frontend-vue-nextSource GCVE Database
Rated by Threat Radar
Data as of 8 Sep 2026, 10:38 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmfrontend-vue-next | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing frontend-vue-next versions 1.0.0 and 1.2.0. Verify package authenticity before installation and prefer well-known, verified packages. Monitor for suspicious network activity during npm installs. Check vendor or repository advisories for updates or removal of the malicious package.
Description
The npm package frontend-vue-next versions 1.0.0 and 1.2.0 contains malicious code that executes automatically during installation. The package runs a script that collects detailed system and user identity information and sends it to an attacker-controlled server. This behavior leaks sensitive host and user data without consent, posing a privacy and security risk to developers and CI environments.