Malicious Code Injection in external_nightingale_dumbs Package
Summary
MAL-2025-102421: Malicious code in external_nightingale_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The external_nightingale_dumbs package is part of a larger ecosystem that has been exploited for malicious purposes, specifically linked to the tea.xyz token reward campaign. This package is designed to interact with the npm registry, allowing developers to publish and manage JavaScript packages. However, its recent exploitation has raised significant concerns regarding its integrity and security.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the external_nightingale_dumbs package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names, which are often themed around Indonesian culture. The primary risk is that it allows for the automatic generation and republishing of derivative packages, leading to pollution of the npm registry and potential misuse of developer reputation scores. This can result in developers inadvertently using compromised packages, exposing their applications to further vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall external_nightingale_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the external_nightingale_dumbs package by using the following command:
npm uninstall external_nightingale_dumbs
Additionally, ensure that your package-lock.json file is monitored for any unauthorized changes.
Conclusion
The external_nightingale_dumbs package has been identified as containing malicious code that poses significant risks to developers and their applications. It is crucial to take immediate action by updating or removing the package and utilizing tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for external_nightingale_dumbs →
FAQ
It is a package associated with the npm ecosystem, which has been exploited for malicious activities related to the tea.xyz token reward campaign.
If your application uses the external_nightingale_dumbs package, it may be at risk of using compromised code that can lead to security breaches and reputation damage.
You should immediately update or uninstall the package to mitigate any potential risks associated with the vulnerability.
Yes, you can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
