Malicious Code Injection in candra-mangut99-ruro Package
Summary
MAL-2025-100227: Malicious code in candra-mangut99-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The candra-mangut99-ruro package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development of applications by providing reusable code. However, it has been identified as part of a malicious campaign that exploits npm's publishing mechanisms, leading to significant security concerns.
Vulnerability Detail
The vulnerability in the candra-mangut99-ruro package stems from its involvement in a malicious scheme that generates and publishes derivative packages with randomized names. This is done through scripts that modify the package.json file to remove private flags, change version numbers, and continuously republish variants. The origin of this issue is linked to the tea.xyz token reward campaign, which aims to inflate developer reputation scores through deceptive practices. The ramifications include potential pollution of the npm registry, exposure of developers to malicious code, and the undermining of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall candra-mangut99-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the candra-mangut99-ruro package and any other packages that may have been published under similar malicious schemes. Monitor your package-lock.json file for any unauthorized changes and consider using tools like Vulert to keep track of vulnerabilities in your dependencies.
Conclusion
The candra-mangut99-ruro package poses a significant security risk due to its malicious code that manipulates npm's publishing system. It is crucial for developers to be vigilant about the packages they use and to regularly monitor for vulnerabilities. By removing this package and utilizing tools like Vulert, developers can protect their applications from potential threats.
See every vulnerability recorded for candra-mangut99-ruro →
FAQ
It is an npm package that has been identified as part of a malicious campaign to exploit npm's publishing mechanisms.
If your application uses the candra-mangut99-ruro package, it may be exposed to malicious code that can compromise security and functionality.
You should uninstall the candra-mangut99-ruro package immediately and check for any other potentially malicious packages in your project.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
