Malicious Code Exploit in continued_caterpillar_dumbs Package
Summary
MAL-2025-100932: Malicious code in continued_caterpillar_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The continued_caterpillar_dumbs package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and sharing of JavaScript code. However, it has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This behavior not only compromises the integrity of the npm registry but also poses significant risks to developers who may unknowingly use these tainted packages.
Vulnerability Detail
The vulnerability stems from the malicious code embedded within the continued_caterpillar_dumbs package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names that are Indonesian-themed or in English. The primary goal of this exploit is to continuously republish variants of the package, thereby polluting the npm registry and potentially leading to security risks for developers who rely on npm for package management. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has been known to flood npm with such malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall continued_caterpillar_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the continued_caterpillar_dumbs package and monitor your package-lock.json file for any unauthorized changes. If you suspect that your project has been affected, consider using tools like Vulert to scan your dependencies for vulnerabilities. You can access the Vulert playground at https://vulert.com/scanner to check if your application is affected without needing to sign up.
Conclusion
The continued_caterpillar_dumbs package poses a significant security risk due to its malicious code designed to manipulate package metadata and pollute the npm registry. It is essential for developers to be vigilant, regularly monitor their dependencies, and utilize tools like Vulert to safeguard their projects from such vulnerabilities.
See every vulnerability recorded for continued_caterpillar_dumbs →
FAQ
It is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores.
The vulnerability can lead to the modification of your package.json file and the introduction of malicious code into your project, potentially compromising its security.
You should uninstall the continued_caterpillar_dumbs package immediately and check your project for any unauthorized changes.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring code access.
Regularly update your dependencies, use trusted sources for packages, and utilize vulnerability scanning tools to keep your project secure.
