Malicious Code Injection in akifmunir Package: npm Vulnerability Overview
Summary
MAL-2025-170768: Malicious code in akifmunir (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The akifmunir package is part of the npm ecosystem, primarily used for JavaScript development. It is often utilized in various applications to manage dependencies and streamline project workflows. However, this package has been identified as part of a malicious campaign that aims to exploit npm's publishing mechanisms, leading to significant security risks for developers and their projects.
Vulnerability Detail
The akifmunir package contains malicious code that modifies the package.json file by removing private flags and changing version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior is part of a broader scheme to inflate developer reputation scores for token rewards associated with the tea.xyz protocol. The ramifications include potential exposure of sensitive information, compromised project integrity, and a polluted npm registry, which can affect other developers relying on legitimate packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall akifmunirIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the akifmunir package and replace it with a similar, trusted package. Always verify the source and integrity of any package before including it in your project.
Conclusion
The akifmunir package poses a significant security risk due to its malicious code designed to manipulate npm's publishing process. Developers are advised to remove this package from their projects and utilize trusted alternatives. Regular monitoring and updates of dependencies are essential to maintain project security.
See every vulnerability recorded for akifmunir →
FAQ
The akifmunir package is an npm package used in JavaScript development, but it has been identified as malicious.
The vulnerability can lead to compromised project integrity, exposure of sensitive information, and pollution of the npm registry.
You should uninstall the akifmunir package immediately and check your project for any other potentially compromised packages.
No, there is no patch available for the akifmunir package. The best course of action is to remove it from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
