Malicious Code Injection in cometcrafter: A Threat to npm Ecosystem
Summary
MAL-2025-171052: Malicious code in cometcrafter (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cometcrafter is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate certain functionalities within the npm ecosystem. However, it has been compromised, leading to significant security concerns. The package is known for its ability to generate and publish derivative packages, which can inflate developer reputation scores for token rewards. This vulnerability exposes users to risks associated with malicious code execution and registry pollution.
Vulnerability Detail
The vulnerability in cometcrafter originates from its association with the tea.xyz token reward campaign, which has been identified as a source of malicious packages flooding the npm registry. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior can lead to the automatic generation and republishing of variants, ultimately polluting the npm registry and compromising the integrity of the ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cometcrafterIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your project for vulnerabilities using tools like Vulert, which can alert you in real-time for open-source vulnerabilities without requiring code access or installation. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner.
Conclusion
The cometcrafter package has been identified as a source of malicious code within the npm ecosystem, posing significant risks to users. It is crucial to take immediate action by uninstalling the package and monitoring for updates. Utilizing tools like Vulert can help maintain the security of your projects by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for cometcrafter →
FAQ
cometcrafter is an npm package associated with the tea.xyz token reward campaign, designed to facilitate certain functionalities within the npm ecosystem.
The vulnerability allows malicious code to be injected into your project, potentially leading to security breaches and pollution of the npm registry.
You should uninstall the cometcrafter package immediately using 'npm uninstall cometcrafter' and monitor for any updates or patches.
Yes, Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
