Malicious Code Injection in cindy-kepok23-ruro Package - npm Vulnerability
Summary
MAL-2025-100465: Malicious code in cindy-kepok23-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cindy-kepok23-ruro package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign that has been flooding npm with malicious packages. These packages are designed to inflate developer reputation scores through automated publishing scripts, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability in the cindy-kepok23-ruro package originates from its malicious code that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, specifically Indonesian-themed or English variants. This behavior allows the package to continuously republish itself and its variants, thereby polluting the npm registry and potentially compromising the integrity of other packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cindy-kepok23-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the cindy-kepok23-ruro package and any other packages that may be associated with the tea.xyz token reward campaign. Regularly audit your npm packages to ensure that no malicious packages are present.
Conclusion
The cindy-kepok23-ruro package poses a significant risk due to its malicious code that modifies package metadata and repopulates the npm registry with harmful variants. It is crucial to remove this package and monitor your dependencies to maintain the integrity of your projects.
See every vulnerability recorded for cindy-kepok23-ruro →
FAQ
The cindy-kepok23-ruro package is an npm package that has been identified as malicious, designed to inflate developer reputation scores through automated publishing.
This vulnerability can lead to the pollution of the npm registry, potentially compromising the integrity of your project and other packages you may depend on.
You should uninstall the cindy-kepok23-ruro package immediately using 'npm uninstall cindy-kepok23-ruro' and check for any dependencies that may be affected.
You can use tools like Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can check your application for vulnerabilities using the Vulert playground without any signup.
Regularly audit your npm packages, use tools like Vulert for monitoring, and stay updated on security advisories related to the packages you use.
