Malicious Code Injection in dono-lapis84-pore Package
Summary
MAL-2025-97718: Malicious code in dono-lapis84-pore (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dono-lapis84-pore package is part of the npm ecosystem, primarily used for various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood npm with packages that manipulate developer reputation scores. This package, like others in the campaign, contains scripts designed to automatically generate and publish derivative packages, leading to potential misuse and pollution of the npm registry.
Vulnerability Detail
The vulnerability in the dono-lapis84-pore package originates from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, which can lead to the proliferation of unwanted packages in the npm registry. The continuous republishing of these variants can inflate developer reputation scores fraudulently, potentially harming the integrity of the npm ecosystem and affecting developers relying on legitimate packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dono-lapis84-poreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using npm's package-lock.json to monitor and restrict the use of vulnerable packages. You can also use the following command to uninstall the package: npm uninstall dono-lapis84-pore.
Conclusion
The dono-lapis84-pore package contains malicious code that poses a significant risk to the npm ecosystem by modifying package metadata and republishing variants. It is crucial to remove this package and monitor for updates to maintain the integrity of your applications.
See every vulnerability recorded for dono-lapis84-pore →
FAQ
The dono-lapis84-pore package is an npm package associated with the tea.xyz token reward campaign, known for generating and publishing derivative packages.
The vulnerability can lead to the pollution of the npm registry with unwanted packages, potentially affecting the integrity and security of your application.
You should remove the dono-lapis84-pore package from your project and monitor for any updates or patches that may address this vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, ensuring you stay informed about potential risks.
