Malicious Code Injection in assistant_moth_z3n Package - npm Vulnerability
Summary
MAL-2025-98623: Malicious code in assistant_moth_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The assistant_moth_z3n package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate automated publishing of derivative packages, which can inflate developer reputation scores. However, it has been identified as containing malicious code that alters package metadata and floods the npm registry with unwanted variants.
Vulnerability Detail
The vulnerability in the assistant_moth_z3n package stems from its malicious payload, which modifies the package.json file to remove private flags, changes version numbers, and generates random package names. This behavior is intended to pollute the npm registry and can lead to significant security risks, including the potential for dependency confusion and exploitation of affected systems. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has been known to flood the npm ecosystem with similar malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall assistant_moth_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the malicious package by using npm's package-lock.json file to monitor dependencies. Ensure that your project does not include assistant_moth_z3n in its dependencies.
Conclusion
The assistant_moth_z3n package has been identified as containing malicious code that alters package metadata and floods the npm registry. It is crucial to remove this package from your project to mitigate potential security risks. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for assistant_moth_z3n →
FAQ
The assistant_moth_z3n package is an npm package associated with automated publishing and is part of a token reward campaign that has been identified as malicious.
This vulnerability can lead to the pollution of the npm registry and may expose your application to security risks, including dependency confusion and exploitation.
You should uninstall the assistant_moth_z3n package immediately using the command: npm uninstall assistant_moth_z3n.
Currently, there is no patched version available. The best course of action is to remove the package from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
