Malicious Code Injection in Entire Gorilla 0xRequest Package - npm Vulnerability
Summary
MAL-2025-102122: Malicious code in entire_gorilla_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Entire Gorilla 0xRequest package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is implicated in a malicious campaign that aims to exploit npm's publishing system. It is designed to facilitate the automatic generation and publication of derivative packages, which can mislead developers and inflate reputation scores for token rewards.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the Entire Gorilla 0xRequest package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. The intent is to continuously republish these variants, thereby polluting the npm registry. This not only compromises the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these tainted packages, potentially leading to security breaches in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall entire_gorilla_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the Entire Gorilla 0xRequest package and consider using alternative packages that provide similar functionality without the associated risks. Always verify the integrity of packages before including them in your project.
Conclusion
The Entire Gorilla 0xRequest package poses a significant threat due to its malicious code designed to exploit the npm registry. It is crucial for developers to be vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive steps, developers can safeguard their applications against such threats.
See every vulnerability recorded for entire_gorilla_0xrequest →
FAQ
It is an npm package that has been identified as part of a malicious campaign to exploit the npm registry by generating and publishing derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Using this package can lead to security vulnerabilities in your application, as it may introduce malicious code that compromises your project's integrity.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and ensure you only use trusted packages from reputable sources.
Immediately uninstall the package using npm uninstall entire_gorilla_0xrequest and review your project for any potential security implications.
