Malicious Code Injection in amjadatef Package - npm Vulnerability
Summary
MAL-2025-170837: Malicious code in amjadatef (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The amjadatef package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and sharing of code. However, it has been identified as part of a malicious campaign that exploits npm's publishing capabilities, leading to potential security risks for developers and their applications.
Vulnerability Detail
The vulnerability stems from malicious code embedded in the amjadatef package, which is linked to the tea.xyz token reward campaign. This code is designed to manipulate the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants, polluting the npm registry and potentially compromising the integrity of applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall amjadatefIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the amjadatef package altogether and look for alternative packages that provide similar functionality without the associated risks.
Conclusion
The amjadatef package has been identified as a malicious entity within the npm ecosystem, posing significant risks to developers and their applications. It is crucial to take immediate action to remove this package and monitor for any similar vulnerabilities in the future.
See every vulnerability recorded for amjadatef →
FAQ
The amjadatef package is a JavaScript package available on npm, primarily used for various development tasks. However, it has been identified as malicious.
You can check if your application is affected by using the Vulert platform, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
If you have installed the amjadatef package, it is recommended to uninstall it immediately using 'npm uninstall amjadatef' and replace it with a secure alternative.
Using malicious packages can lead to compromised security, data breaches, and the potential for unauthorized access to your application and its users.
To prevent similar vulnerabilities, regularly audit your dependencies, use trusted sources, and consider employing tools like Vulert to monitor your projects for vulnerabilities.
