Malicious Code Injection in eldest_shark_z3n Package
Summary
MAL-2025-94203: Malicious code in eldest_shark_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eldest_shark_z3n package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate the automatic generation and publication of derivative packages, which are often used to inflate developer reputation scores for token rewards. Its functionality includes creating randomized package names and modifying package metadata, making it susceptible to exploitation.
Vulnerability Detail
The vulnerability in the eldest_shark_z3n package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of variants that pollute the npm registry. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which employs autopublish scripts to automate these malicious activities. The ramifications include potential security risks for developers and users relying on the npm registry, as well as the degradation of the integrity of the package ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eldest_shark_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily avoid using the eldest_shark_z3n package in your project. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The eldest_shark_z3n package poses a significant security risk due to its malicious code that modifies package metadata and repopulates the npm registry with harmful variants. Developers should take immediate action to remove this package and monitor their dependencies for vulnerabilities.
See every vulnerability recorded for eldest_shark_z3n →
FAQ
The eldest_shark_z3n package is an npm package associated with the tea.xyz token reward campaign, designed to automate the generation and publication of derivative packages.
This vulnerability allows the package to modify package metadata, remove private flags, and continuously republish variants, which can lead to pollution of the npm registry.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no specific patch available for the eldest_shark_z3n package. It is advisable to remove the package from your project.
If you have used the eldest_shark_z3n package, it is recommended to remove it immediately and monitor your project for any unusual behavior.
