Malicious Code Injection in amjadmalk Package: npm Vulnerability Overview
Summary
MAL-2025-170855: Malicious code in amjadmalk (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The amjadmalk package is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to exploit npm's publishing mechanisms. It is designed to automatically generate and publish derivative packages, potentially compromising the integrity of the npm registry and affecting developers' reputations.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the amjadmalk package. This payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. The malicious scripts (auto.js, autopublish.js, etc.) continuously republish these variants, leading to pollution of the npm registry and potential misuse of developer reputation scores. The ramifications include compromised package integrity, increased risk of dependency confusion, and potential exploitation of users who unknowingly install these malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall amjadmalkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the amjadmalk package altogether. If you must use it, consider implementing strict package validation and monitoring tools to detect any unauthorized changes in your dependencies.
Conclusion
The amjadmalk package poses a significant risk due to its malicious code designed to exploit npm's publishing system. It is essential for developers to remain vigilant, update their dependencies, and utilize monitoring tools like Vulert to safeguard their projects against such vulnerabilities.
See every vulnerability recorded for amjadmalk →
FAQ
The amjadmalk package is an npm package that has been identified as part of a malicious campaign aimed at exploiting npm's publishing system.
The malicious code can alter your project's dependencies, remove private flags, and publish unauthorized versions, potentially compromising your project's integrity.
If you have installed amjadmalk, you should immediately update it to the latest version or remove it from your project to mitigate risks.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring code access or installation.
You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without needing to sign up.
