Malicious Code Injection in deaf_ape_dumbs Package: npm Vulnerability Summary
Summary
MAL-2025-101226: Malicious code in deaf_ape_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The deaf_ape_dumbs package is part of a series of malicious npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify critical files and republish variants, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in the deaf_ape_dumbs package originates from its malicious intent to manipulate the package.json file. It removes private flags, alters version numbers, and generates random package names, which can lead to significant security risks, including unauthorized access to sensitive data and the proliferation of malicious packages in the npm ecosystem. This behavior is part of a broader trend where malicious actors exploit npm's publishing capabilities to gain undue advantages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall deaf_ape_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the deaf_ape_dumbs package and monitor your project for any dependencies that may inadvertently include it. You can also use tools like Vulert to monitor your package-lock.json for vulnerabilities in real-time without requiring any code access or installation.
Conclusion
The deaf_ape_dumbs package represents a significant security threat within the npm ecosystem due to its malicious functionality. It is crucial for developers to be aware of such vulnerabilities and take proactive measures to secure their projects. Regular monitoring and prompt action can help mitigate the risks associated with these types of packages.
See every vulnerability recorded for deaf_ape_dumbs →
FAQ
The deaf_ape_dumbs package is a malicious npm package that is part of a campaign to inflate developer reputation scores through automated publishing of derivative packages.
This vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing your project to security risks and polluting the npm registry.
If you have installed the deaf_ape_dumbs package, you should uninstall it immediately using the command npm uninstall deaf_ape_dumbs.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert offers a service that monitors your package-lock.json for open-source vulnerabilities in real-time, alerting you to any issues as they arise.
