Malicious Code Vulnerability in commercial_tick_0xrequest Package
Summary
MAL-2025-100713: Malicious code in commercial_tick_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The commercial_tick_0xrequest package is part of the npm ecosystem and is often used in JavaScript applications. It is designed to facilitate various functionalities, but it has been compromised as part of a broader malicious campaign targeting npm packages. This vulnerability is particularly concerning as it can lead to the automatic generation and publication of harmful derivative packages, impacting the integrity of the npm registry and potentially affecting developers' reputations.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the commercial_tick_0xrequest package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names, which are often themed around Indonesian culture. The malicious code is designed to continuously republish these variants, polluting the npm registry and inflating developer reputation scores through deceptive practices. This can lead to significant security risks, including the potential for further exploitation and the spread of malicious code across dependent projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall commercial_tick_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the commercial_tick_0xrequest package and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider implementing strict package validation and monitoring practices to detect any unauthorized changes to your dependencies.
Conclusion
The commercial_tick_0xrequest package has been identified as a vector for malicious code, posing significant risks to developers and the integrity of the npm ecosystem. It is crucial to take immediate action to remove this package and monitor your dependencies for any vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for commercial_tick_0xrequest →
FAQ
It is an npm package used in JavaScript applications, but it has been compromised and is now associated with malicious activities.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should uninstall the commercial_tick_0xrequest package immediately and replace it with a secure alternative.
The malicious code can alter your package.json file, leading to the publication of harmful packages and potentially compromising your application's security.
Yes, if not addressed, this vulnerability can lead to further exploitation, reputation damage for developers, and a polluted npm registry.
