Malicious Code Injection in developing_antlion_0xrequest Package
Summary
MAL-2025-101391: Malicious code in developing_antlion_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The developing_antlion_0xrequest package is part of a larger ecosystem within npm that has been exploited for malicious purposes. It is associated with the tea.xyz token reward campaign, which has led to the proliferation of packages designed to manipulate developer reputation scores. This package, like others in its category, is intended to automate the publication of derivative packages, often with randomized names, to inflate visibility and credibility in the npm registry.
Vulnerability Detail
The vulnerability in the developing_antlion_0xrequest package stems from its malicious payload, which modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to clutter the npm registry. This behavior not only compromises the integrity of the npm ecosystem but also poses risks to developers who may unknowingly integrate these malicious packages into their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall developing_antlion_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the developing_antlion_0xrequest package and look for alternative packages that provide similar functionality without the associated risks. Always verify the integrity and reputation of packages before including them in your project.
Conclusion
The developing_antlion_0xrequest package poses significant risks due to its malicious behavior, which includes modifying critical files and republishing harmful variants. It is essential for developers to remain vigilant and proactive in managing their dependencies to safeguard their projects from such vulnerabilities.
See every vulnerability recorded for developing_antlion_0xrequest →
FAQ
It is an npm package that has been identified as malicious, designed to manipulate developer reputation scores through automated publishing of derivative packages.
If your project includes this package, it may inadvertently contribute to the pollution of the npm registry and expose your application to further security risks.
You can use Vulert, a service that monitors open-source vulnerabilities in your software. By uploading your package-lock.json file, you can receive real-time alerts about vulnerabilities, including this one.
There is no patch for the developing_antlion_0xrequest package itself, as it is recommended to remove the package entirely from your project.
You should uninstall the package immediately and review your project's dependencies for any other potentially malicious packages.
