Malicious Code Vulnerability in citra-rawon92-ruro Package
Summary
MAL-2025-100547: Malicious code in citra-rawon92-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The citra-rawon92-ruro package is part of the npm ecosystem and has been identified as part of a malicious campaign targeting developers. This package is associated with the tea.xyz token reward initiative, which has led to the proliferation of numerous derivative packages designed to inflate developer reputation scores. The malicious nature of this package lies in its ability to modify essential files and republish itself under various names, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in the citra-rawon92-ruro package stems from its malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants. This behavior not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly install these malicious packages, potentially leading to further exploitation or data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall citra-rawon92-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the citra-rawon92-ruro package and consider using alternative packages that provide similar functionality without the associated risks. Additionally, regularly audit your dependencies using tools like npm audit to identify and address vulnerabilities.
Conclusion
The citra-rawon92-ruro package poses a significant risk due to its malicious code that modifies package files and repopulates the npm registry with potentially harmful variants. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the security of their projects.
See every vulnerability recorded for citra-rawon92-ruro →
FAQ
The citra-rawon92-ruro package is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through the creation of derivative packages.
This vulnerability can compromise your project's integrity by introducing malicious code that modifies essential files and republishing itself under various names, potentially leading to further exploitation.
You should uninstall the citra-rawon92-ruro package immediately using 'npm uninstall citra-rawon92-ruro' and monitor your project for any unusual activity.
You can use tools like npm audit to regularly check for vulnerabilities in your dependencies. Additionally, Vulert can help monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
