Malicious Code Injection in dizzy_koala-tool - npm Package Vulnerability
Summary
MAL-2025-101687: Malicious code in dizzy_koala-tool (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dizzy_koala-tool is an npm package that has been identified as part of a malicious campaign targeting the npm registry. This package is designed to automate the generation and publication of derivative packages, which can inflate developer reputation scores in exchange for token rewards. Its functionality includes creating random package names and modifying existing package metadata, making it susceptible to exploitation.
Vulnerability Detail
This vulnerability originates from the package being part of the tea.xyz token reward campaign, which has been known to flood the npm ecosystem with malicious packages. The malicious code within dizzy_koala-tool modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior can lead to the pollution of the npm registry, making it difficult for developers to find legitimate packages and potentially compromising their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dizzy_koala-toolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the installation of this package by using npm's package-lock.json to monitor dependencies. Ensure that your package-lock.json does not include dizzy_koala-tool. You can also use Vulert to monitor your project for vulnerabilities in real-time without requiring code access or installation.
Conclusion
The dizzy_koala-tool package poses a significant risk due to its malicious code designed to manipulate package metadata and inflate developer reputation scores. It is essential to remove this package from your project and monitor your dependencies for vulnerabilities.
See every vulnerability recorded for dizzy_koala-tool →
FAQ
The dizzy_koala-tool is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through automated package publishing.
The vulnerability can lead to the pollution of the npm registry, making it harder to find legitimate packages and potentially compromising your application's security.
You should uninstall the dizzy_koala-tool package immediately using the command: npm uninstall dizzy_koala-tool.
Currently, there is no patched version available. The best course of action is to remove the package from your project.
You can use Vulert to monitor your project for open-source vulnerabilities in real-time by analyzing your package-lock.json file.
