MalwarePublished 13 Oct 2026Updated 3 Nov 2026

@user-interface-common/common-styles (npm) · Malicious Code

Affects @user-interface-common/common-stylesSource GCVE Database

Malicious package : remove @user-interface-common/common-styles and rotate any secrets on hosts that installed it.

Data as of 3 Nov 2026, 23:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17874

What to do

Remove @user-interface-common/common-styles from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@user-interface-common/common-styles	Affected =66.1.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @user-interface-common/common-styles version 66.1.6 is a malicious package published as part of a dependency confusion campaign. It includes a preinstall script that runs code sending an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and identifying information about the installed package. This behavior indicates that any system installing this package may be compromised.

Impact

Installation of this package results in the victim's system sending identifying information and public IP address to an attacker-controlled server, potentially exposing internal package usage and network details. The ghsa-malware source states that any computer with this package installed should be considered fully compromised, recommending immediate rotation of all secrets and keys and removal of the package. However, removal alone may not guarantee full remediation due to possible further compromise.

Defensive guidance

Remove the malicious package @user-interface-common/common-styles version 66.1.6 immediately. Rotate all secrets and keys stored on the affected system from a separate, uncompromised device. Treat any system that installed this package as fully compromised and conduct a thorough security assessment.

Summary

The npm package @user-interface-common/common-styles, published by the user 'conx3993', is a malicious package designed for dependency confusion attacks. It uses a preinstall lifecycle script to execute index.js, which sends an HTTPS GET request to https://realwbx.com/ip.php with a hardcoded authorization token unique to the package. This request leaks the victim's public egress IP and signals to the attacker which internal package was installed. The package masquerades as a UI styles library but its actual behavior is to beacon installation events to an external malicious host. The package version 66.1.6 is specifically identified as malicious.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2026, 23:58 UTC

Technical details

References

Community reviews