Malicious Code Injection in callback-optimize-css-assets-webpack-plugin-indus-markdown Package
Summary
MAL-2025-140301: Malicious code in callback-optimize-css-assets-webpack-plugin-indus-markdown (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The callback-optimize-css-assets-webpack-plugin-indus-markdown package is part of the npm ecosystem and is used for optimizing CSS assets in web applications. However, it has been identified as part of a malicious campaign that floods the npm registry with derivative packages, which can compromise the integrity of applications relying on it.
Vulnerability Detail
This vulnerability originates from a malicious campaign that targets npm packages, specifically those associated with the tea.xyz token reward system. The affected package contains scripts designed to automatically publish derivative packages with altered metadata, including the removal of private flags and the generation of random package names. This behavior can lead to the pollution of the npm registry and potentially expose applications to further vulnerabilities or malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall callback-optimize-css-assets-webpack-plugin-indus-markdownIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the installation of this malicious package by using npm's package-lock.json to lock your dependencies. Ensure that your project does not include this package by checking your package.json and removing any references to it.
Conclusion
The callback-optimize-css-assets-webpack-plugin-indus-markdown package has been identified as a vector for malicious code injection, posing significant risks to applications that utilize it. It is essential to remove this package and monitor for updates or alternatives to ensure the security of your project.
See every vulnerability recorded for callback-optimize-css-assets-webpack-plugin-indus-markdown →
FAQ
It is an npm package used for optimizing CSS assets in web applications, but it has been compromised with malicious code.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json, it can help you determine if your application is affected.
Using this package can lead to the pollution of the npm registry, potential exposure to further vulnerabilities, and the risk of executing malicious code in your application.
Yes, you can lock your dependencies using package-lock.json and regularly audit your packages for vulnerabilities.
Remove the package from your project immediately and consider using a secure alternative. Monitor your dependencies for any updates or patches.
