Which versions of bsd-ui-stylekit are malicious?

The following npm versions of bsd-ui-stylekit are flagged malicious: 0.3.13, 0.3.14, 0.3.70, 99.0.0. Treat any of these as compromised.

How do I remediate bsd-ui-stylekit if I installed it?

Remove bsd-ui-stylekit from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed bsd-ui-stylekit — how do I know if it already compromised me?

If bsd-ui-stylekit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is bsd-ui-stylekit part of a known attack campaign?

Yes — bsd-ui-stylekit is associated with the RLMA-2025-04473, RLUA-2025-06074 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find bsd-ui-stylekit across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for bsd-ui-stylekit (4 malicious versions).

Malicious package

bsd-ui-stylekitnpm

Advisory published Aug 28, 2025Updated Dec 24, 2025

bsd-ui-stylekit is a confirmed malicious npm package (MAL-2025-41538) that executes malicious code on install (malicious versions 0.3.13, 0.3.14, 0.3.70…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in bsd-ui-stylekit (npm)

MAL-2025-41538

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall bsd-ui-stylekit

Malicious versions

4 flagged

0.3.130.3.140.3.7099.0.0

Indicators of compromise (SHA-256)

dc0a6102193c1358f1b45688612630aeace11e3896a6f73e20d356c1229de485

6c91e82c9d814fe53b7aa7f1cd65f949fcba5829765d9e86a57fa6c0ef49406d

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for bsd-ui-stylekit (4 malicious versions).
If you installed it — respond
Remove bsd-ui-stylekit from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If bsd-ui-stylekit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. bsd-ui-stylekit on npm has been identified as a malicious package (versions 0.3.13, 0.3.14, 0.3.70, 99.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-04473RLUA-2025-06074

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks bsd-ui-stylekit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database