MalwarePublished 9 Jun 2026Updated 29 Jun 2026

ui-ng-components (npm) · Malicious Code

Affects ui-ng-componentsSource GCVE Database

Malicious package : remove ui-ng-components and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5454

What to do

Remove ui-ng-components from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmui-ng-components	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ui-ng-components version 99.9.1 is a malicious package designed for dependency confusion attacks. It contains no legitimate code but declares a dependency on a remote tarball hosted outside the npm registry. Installing this package triggers execution of potentially harmful lifecycle scripts from the external tarball, compromising the installer's machine. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated immediately. Removal of the package alone does not guarantee full remediation due to possible persistent malicious activity.

Impact

Systems that have installed ui-ng-components@99.9.1 are considered fully compromised. Attackers may have gained full control over the affected machine, potentially accessing all stored secrets and keys. The compromise may persist beyond removal of the package due to installed malware or backdoors. Immediate secret/key rotation is required from a secure environment to prevent further unauthorized access.

Defensive guidance

The recommended mitigation is to remove ui-ng-components@99.9.1 immediately from all affected systems. All secrets and keys stored on compromised machines must be rotated from a different, secure computer. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any signs of persistent malicious activity beyond package removal.

Summary

The ui-ng-components package at version 99.9.1 is an empty shell with no author or functionality, crafted to perform a dependency confusion attack by referencing an external tarball URL as a dependency. When installed via npm, the external tarball is fetched and its lifecycle scripts execute on the victim's machine, potentially allowing full system compromise. The package itself contains no library code; its sole purpose is to deliver and execute malicious code from the remote tarball. This attack vector exploits the npm install process and the trust in package dependencies, making any system with this package installed fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:17 UTC

Technical details

References

Community reviews