Malicious Code Injection in chandnipandey Package: npm Vulnerability Overview
Summary
MAL-2025-171019: Malicious code in chandnipandey (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chandnipandey package is part of the npm ecosystem, which is widely used for JavaScript package management. It is often utilized in various applications to manage dependencies and streamline development processes. However, this package has been identified as part of a malicious campaign that aims to exploit the npm registry by flooding it with derivative packages that are generated automatically. This vulnerability poses significant risks to developers and users alike, as it can lead to reputation inflation and potential security breaches.
Vulnerability Detail
The vulnerability in the chandnipandey package originates from its association with the tea.xyz token reward campaign. This campaign has been known to deploy autopublish scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names. The continuous republishing of these variants can pollute the npm registry, making it difficult for developers to identify legitimate packages. The malicious payload can compromise the integrity of applications relying on this package, leading to potential security risks and loss of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chandnipandeyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
While there is no direct workaround to mitigate the effects of this vulnerability, you can monitor your dependencies using tools like Vulert. By utilizing Vulert, you can check if your application is affected by this vulnerability without requiring access to the code or installation. You can use the Vulert playground at https://vulert.com/scanner to analyze your package-lock.json file for vulnerabilities.
Conclusion
The chandnipandey package has been identified as a malicious entity within the npm ecosystem, posing significant risks to developers and applications. Immediate action is required to remove this package and safeguard your projects. Utilizing tools like Vulert can help you stay informed about potential vulnerabilities in your dependencies.
See every vulnerability recorded for chandnipandey →
FAQ
The chandnipandey package is an npm package that has been identified as part of a malicious campaign aimed at exploiting the npm registry.
The vulnerability can lead to the injection of malicious code, compromising the integrity of your application and potentially exposing it to security risks.
You should uninstall the chandnipandey package immediately using the command npm uninstall chandnipandey and check your package-lock.json for any references to it.
Currently, there is no patched version of the chandnipandey package available, so complete removal is the only option.
You can use Vulert to monitor your dependencies in real-time for open-source vulnerabilities by analyzing your package-lock.json file.
