Embedded Malicious Code Affecting @operato/layout package, versions =9.0.35=9.0.36=9.0.37
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPERATOLAYOUT-12744513
- published16 Sept 2025
- disclosed15 Sept 2025
- creditDaniel Pereira
Introduced: 15 Sep 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @operato/layout package.
Overview
Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them to further compromise downstream packages. Malicious repositories associated with this package compromise attack, as well as branches on existing repositories that have been affected, involve the string "shai-hulud" and variations thereof.