Which versions of @sarex-team/ui-kit are malicious?

The following npm versions of @sarex-team/ui-kit are flagged malicious: 9.9.11. Treat any of these as compromised.

How do I remediate @sarex-team/ui-kit if I installed it?

@sarex-team/ui-kit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @sarex-team/ui-kit — how do I know if it already compromised me?

If @sarex-team/ui-kit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @sarex-team/ui-kit part of a known attack campaign?

Yes — @sarex-team/ui-kit is associated with the IN-MAL-2026-018292 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @sarex-team/ui-kit across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @sarex-team/ui-kit (version 9.9.11).

Malicious package

@sarex-team/ui-kitnpm

@sarex-team/ui-kit is a confirmed malicious npm package (MAL-2026-14206) that steals credentials and exfiltrates sensitive data (malicious version 9.9.11). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @sarex-team/ui-kit (npm)

MAL-2026-14206

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @sarex-team/ui-kit

What this malware does

@sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install (via package.json scripts.install = node index.js) and on require('@sarex-team/ui-kit') (top-level require of lib/core.js from index.js, wrapped in silent try/catch). lib/core.js collects the installer's OS username, hostname, and current working-directory basename and issues a dns.resolve4 lookup against a subdomain of oob.sl4x0.xyz built from those values, leaking host identity through DNS. The sensitive API names ('os', 'dns', 'process', 'userInfo', 'username', 'hostname', 'cwd', 'resolve4') and the destination domain 'oob.sl4x0.xyz' are reconstructed at runtime from hex char-code arrays in lib/b02e30.js and lib/6ad264.js (obfuscator.io-style _0x-prefixed identifiers) to evade static detection. The package presents itself as 'Enterprise-grade utilities' with decoy validation/formatting/network/crypto/async modules under src/, and its homepage/repo URL github.com/slaxorg/@sarex-team/ui-kit is malformed and does not resolve to a real repository. The author email [email protected] matches the exfiltration domain sl4x0.xyz.

Malicious versions

1 flagged

9.9.11

Indicators of compromise (SHA-256)

722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @sarex-team/ui-kit (version 9.9.11).
If you installed it — respond
@sarex-team/ui-kit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @sarex-team/ui-kit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @sarex-team/ui-kit on npm has been identified as a malicious package (version 9.9.11 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-018292

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @sarex-team/ui-kit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database