Malicious Code Injection in electoral_marten-excellentdev Package
Summary
MAL-2025-102009: Malicious code in electoral_marten-excellentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The electoral_marten-excellentdev package is part of the npm ecosystem, often utilized for various JavaScript applications. It is designed to facilitate certain functionalities within projects but has been compromised by malicious actors. This package is associated with the tea.xyz token reward campaign, which has led to the proliferation of similar malicious packages that manipulate npm's registry.
Vulnerability Detail
The vulnerability originates from the package being part of a campaign that floods the npm registry with malicious code. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior is intended to inflate developer reputation scores for token rewards, leading to potential security risks, including the pollution of the npm registry and unintended consequences for developers relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall electoral_marten-excellentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can remove the package from your project by executing the following command in your terminal: npm uninstall electoral_marten-excellentdev. This will prevent any malicious code from executing in your application.
Conclusion
The electoral_marten-excellentdev package has been identified as containing malicious code that can compromise the security of applications using it. It is crucial for developers to remove this package and monitor their projects for vulnerabilities to ensure the integrity of their software.
See every vulnerability recorded for electoral_marten-excellentdev →
FAQ
It is an npm package that has been compromised and is associated with a malicious campaign to inflate developer reputation scores.
The vulnerability can lead to the pollution of the npm registry and may introduce malicious code into your application, compromising its security.
You should uninstall the electoral_marten-excellentdev package immediately to mitigate any potential risks.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
