Malicious Code Injection in bella-lapis46-ruro Package
Summary
MAL-2025-99901: Malicious code in bella-lapis46-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bella-lapis46-ruro package is part of the npm ecosystem, often utilized for various JavaScript applications. It is known for its role in the tea.xyz token reward campaign, which has been associated with a surge of malicious packages flooding the npm registry. This package, like many others in this campaign, is designed to inflate developer reputation scores through automated scripts.
Vulnerability Detail
The vulnerability in the bella-lapis46-ruro package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of these variants. The primary risk is the pollution of the npm registry, which can compromise the integrity of the ecosystem and potentially lead to further exploitation by malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bella-lapis46-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the bella-lapis46-ruro package by using npm's package-lock.json to monitor dependencies. If you suspect that your project may be affected, consider using the Vulert platform to check for vulnerabilities without needing to install any software. You can access the Vulert playground at https://vulert.com/scanner.
Conclusion
The bella-lapis46-ruro package poses a significant risk due to its malicious code that alters project files and contributes to npm registry pollution. It is essential to uninstall this package and monitor your dependencies for vulnerabilities using tools like Vulert to maintain the security of your projects.
See every vulnerability recorded for bella-lapis46-ruro →
FAQ
The bella-lapis46-ruro package is an npm package associated with the tea.xyz token reward campaign, known for containing malicious code.
The malicious code modifies your package.json file, potentially leading to the pollution of the npm registry and compromising your project's integrity.
You should uninstall the bella-lapis46-ruro package immediately using 'npm uninstall bella-lapis46-ruro' and check for other vulnerabilities in your project.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring installation.
There is no patch for the bella-lapis46-ruro package itself, as it is recommended to uninstall it completely.
