Malicious Code Injection in eclipseexplorer: A Threat to npm Users
Summary
MAL-2025-171127: Malicious code in eclipseexplorer (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eclipseexplorer is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate certain functionalities within the npm ecosystem, but it has been compromised, leading to significant security concerns. The malicious nature of this package stems from its ability to manipulate package metadata and publish harmful derivatives, which can affect developers' reputations and the integrity of the npm registry.
Vulnerability Detail
The vulnerability in eclipseexplorer originates from its association with a malicious campaign that floods the npm registry with derivative packages. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names, which can lead to the pollution of the npm registry. This not only affects the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eclipseexplorerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the eclipseexplorer package from your project by executing: npm uninstall eclipseexplorer. This will prevent any potential malicious activity associated with this package until a fix is applied.
Conclusion
The eclipseexplorer package has been identified as a vector for malicious code injection, posing significant risks to developers and the npm ecosystem. It is crucial to take immediate action by updating or removing the package to safeguard your projects. Utilizing tools like Vulert can further enhance your security posture by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for eclipseexplorer →
FAQ
The vulnerability involves malicious code that modifies package metadata and floods the npm registry with harmful derivatives.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
If you have installed eclipseexplorer, it is recommended to uninstall it immediately and check for any updates or patches.
Yes, using compromised packages can lead to security breaches, data loss, and damage to your project's reputation.
Vulert uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities, helping developers maintain secure applications.
