Malicious code in vxui-react (npm)
The vxui-react npm package versions 1.3.2, 1.3.3, and 1.3.4 contain malicious code executed during installation. The postinstall script downloads and runs an attacker-controlled binary disguised as an ssh daemon, enabling arbitrary code execution on the installing machine. This compromises the system fully, risking exposure of all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious components.
AI Analysis
Technical Summary
The vxui-react npm package (versions 1.3.2, 1.3.3, and 1.3.4) includes a postinstall script that executes a curl command to download a binary from an unrelated GitHub repository, disables TLS verification, suppresses errors, and runs the binary in the background under a hidden path (/tmp/.sshd). This results in arbitrary attacker-controlled code execution on any system running 'npm install vxui-react'. The package also self-references in dependencies, indicating possible namespace or dependency graph manipulation. The malicious binary grants full compromise of the host system.
Potential Impact
Systems installing these vxui-react versions are fully compromised due to arbitrary code execution during package installation. Attackers gain persistent access via the dropped binary, potentially exposing all stored secrets and keys. The compromise is severe enough that removing the package alone may not restore system integrity.
Mitigation Recommendations
No official patch or fix is currently available. Users should immediately remove the affected vxui-react package versions (=1.3.2, =1.3.3, =1.3.4) from their environments. All secrets and keys on compromised systems must be rotated from a separate, trusted machine. Given the full compromise risk, affected systems should be considered untrusted and undergo thorough incident response and remediation.
Malicious code in vxui-react (npm)
Description
The vxui-react npm package versions 1.3.2, 1.3.3, and 1.3.4 contain malicious code executed during installation. The postinstall script downloads and runs an attacker-controlled binary disguised as an ssh daemon, enabling arbitrary code execution on the installing machine. This compromises the system fully, risking exposure of all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious components.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vxui-react npm package (versions 1.3.2, 1.3.3, and 1.3.4) includes a postinstall script that executes a curl command to download a binary from an unrelated GitHub repository, disables TLS verification, suppresses errors, and runs the binary in the background under a hidden path (/tmp/.sshd). This results in arbitrary attacker-controlled code execution on any system running 'npm install vxui-react'. The package also self-references in dependencies, indicating possible namespace or dependency graph manipulation. The malicious binary grants full compromise of the host system.
Potential Impact
Systems installing these vxui-react versions are fully compromised due to arbitrary code execution during package installation. Attackers gain persistent access via the dropped binary, potentially exposing all stored secrets and keys. The compromise is severe enough that removing the package alone may not restore system integrity.
Mitigation Recommendations
No official patch or fix is currently available. Users should immediately remove the affected vxui-react package versions (=1.3.2, =1.3.3, =1.3.4) from their environments. All secrets and keys on compromised systems must be rotated from a separate, trusted machine. Given the full compromise risk, affected systems should be considered untrusted and undergo thorough incident response and remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4793
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-783r-3958-xf8p"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a3ef7be27e9c79719ffd4ed
Added to database: 06/26/2026, 22:05:50 UTC
Last enriched: 07/09/2026, 10:49:53 UTC
Last updated: 07/18/2026, 17:27:21 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.