Malicious Code Injection in candra-lupis70-pore Package
Summary
MAL-2025-97634: Malicious code in candra-lupis70-pore (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The candra-lupis70-pore package is part of the npm ecosystem, often used for various JavaScript applications. It has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This package is particularly vulnerable due to its design, which allows for the modification of critical files like package.json.
Vulnerability Detail
The vulnerability originates from the candra-lupis70-pore package being associated with the tea.xyz token reward campaign. It contains scripts that automatically publish derivative packages with randomized names, effectively polluting the npm registry. The malicious payload alters the package.json file by removing private flags and changing version numbers, which can lead to unauthorized access and misuse of the package. This behavior can severely impact developers relying on the integrity of the npm registry.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall candra-lupis70-poreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the candra-lupis70-pore package altogether. If it is already included in your project, consider removing it and replacing it with a trusted alternative. Additionally, you can monitor your package dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Conclusion
The candra-lupis70-pore package poses a significant risk due to its malicious code that modifies critical files and pollutes the npm registry. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the security and integrity of their applications.
See every vulnerability recorded for candra-lupis70-pore →
FAQ
candra-lupis70-pore is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores.
This vulnerability can lead to unauthorized modifications of your package.json file, potentially compromising your application's integrity and security.
You should remove the candra-lupis70-pore package from your project and consider updating to a patched version if available.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities and alerts you in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
