Malicious Code Injection in aldipratama Package: npm Vulnerability Overview
Summary
MAL-2025-170780: Malicious code in aldipratama (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aldipratama package is part of the npm ecosystem, typically utilized for various JavaScript applications. It is known for its integration within the tea.xyz token reward campaign, which aims to incentivize developers through token rewards. However, this package has been compromised, leading to significant security concerns due to its malicious functionalities.
Vulnerability Detail
The vulnerability in the aldipratama package stems from its association with a malicious campaign that floods the npm registry with derivative packages. The malicious code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which can lead to the pollution of the npm registry. This behavior not only affects the integrity of the package but also poses risks to developers who may unknowingly use these compromised packages, potentially leading to reputational damage and security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall aldipratamaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the aldipratama package and monitor your project for any dependencies that may have been affected by this vulnerability. You can also use the following command to check for vulnerabilities in your project: npm audit.
Conclusion
The aldipratama package has been identified as a vector for malicious code injection, posing significant risks to developers and the integrity of the npm registry. Immediate action is required to remove this package and safeguard your projects. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for aldipratama →
FAQ
The aldipratama package is an npm package that has been linked to a malicious campaign aimed at inflating developer reputation scores through the creation of derivative packages.
The malicious code can modify your package.json file, remove private flags, and generate random package names, which can lead to security vulnerabilities and pollution of the npm registry.
You should uninstall the aldipratama package immediately using the command npm uninstall aldipratama and check for any dependencies that may be affected.
Yes, you can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities without any signup at the Vulert playground.
Regularly audit your npm packages using npm audit, keep your dependencies updated, and consider using tools like Vulert for real-time monitoring of vulnerabilities.
