Malicious Code Injection in bella-liwet79-ruro: A Threat to npm Users
Summary
MAL-2025-99903: Malicious code in bella-liwet79-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'bella-liwet79-ruro' is part of a malicious campaign targeting npm users, specifically designed to exploit the npm registry. This package is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of this package is evident in its functionality, which includes modifying critical files and continuously republishing variants to pollute the npm ecosystem.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the 'bella-liwet79-ruro' package. This code is designed to alter the package.json file by removing private flags, changing version numbers, and generating random package names. The result is a continuous cycle of republishing these variants, which not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly install these malicious packages. The origin of this vulnerability is linked to the broader tea.xyz token reward campaign, which has been flooding the npm ecosystem with similar malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bella-liwet79-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'bella-liwet79-ruro' package and monitor your dependencies for any similar malicious packages. Utilize tools like Vulert to check for vulnerabilities in your project. You can access the Vulert playground at https://vulert.com/scanner to see if your application is affected by this vulnerability without needing to sign up.
Conclusion
The 'bella-liwet79-ruro' package poses a significant threat to npm users due to its malicious code designed to manipulate package files and republish harmful variants. It is crucial to take immediate action by uninstalling the package and utilizing tools like Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for bella-liwet79-ruro →
FAQ
The 'bella-liwet79-ruro' package is a malicious npm package associated with a token reward campaign that aims to inflate developer reputation scores.
This vulnerability can compromise the integrity of your project by introducing malicious code that alters critical files and republishing harmful variants.
You should uninstall the 'bella-liwet79-ruro' package immediately and monitor your dependencies for any other malicious packages.
Yes, Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just the package-lock.json file. You can check your application at Vulert Scanner.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about known vulnerabilities in the npm ecosystem.
