MalwarePublished 26 May 2026Updated 8 Jul 2026

vxui-react (npm) · Malicious Code

Affects vxui-reactSource GCVE Database

Malicious package : remove vxui-react and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4793

What to do

Remove vxui-react from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvxui-react	Affected =1.3.2 =1.3.4 =1.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The vxui-react npm package versions 1.3.2, 1.3.3, and 1.3.4 contain malicious code executed during installation. The postinstall script downloads and runs an attacker-controlled binary disguised as an ssh daemon, enabling arbitrary code execution on the installing machine. This compromises the system fully, risking exposure of all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious components.

Impact

Systems installing these vxui-react versions are fully compromised due to arbitrary code execution during package installation. Attackers gain persistent access via the dropped binary, potentially exposing all stored secrets and keys. The compromise is severe enough that removing the package alone may not restore system integrity.

Defensive guidance

Users should immediately remove the affected vxui-react package versions (=1.3.2, =1.3.3, =1.3.4) from their environments. All secrets and keys on compromised systems must be rotated from a separate, trusted machine. Given the full compromise risk, affected systems should be considered untrusted and undergo thorough incident response and remediation.

Summary

The vxui-react npm package (versions 1.3.2, 1.3.3, and 1.3.4) includes a postinstall script that executes a curl command to download a binary from an unrelated GitHub repository, disables TLS verification, suppresses errors, and runs the binary in the background under a hidden path (/tmp/.sshd). This results in arbitrary attacker-controlled code execution on any system running 'npm install vxui-react'. The package also self-references in dependencies, indicating possible namespace or dependency graph manipulation. The malicious binary grants full compromise of the host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:49 UTC

Technical details

References

Community reviews