Malicious Code Injection in female_angelfish_requirement Package
Summary
MAL-2025-94483: Malicious code in female_angelfish_requirement (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The female_angelfish_requirement package is part of the npm ecosystem, typically used for managing dependencies in JavaScript applications. This package has been identified as part of a malicious campaign that aims to exploit npm's package publishing system. It is designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability originates from the package being part of the tea.xyz token reward campaign, which has been flooding npm with malicious packages. The malicious code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior can lead to unauthorized access to sensitive information and can compromise the integrity of the npm registry, affecting developers and users relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall female_angelfish_requirementIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the female_angelfish_requirement package and replace it with a trusted alternative. Additionally, you can monitor your project for any unauthorized changes to package.json and ensure that your dependencies are secure.
Conclusion
The female_angelfish_requirement package poses a significant security risk due to its malicious code designed to exploit the npm ecosystem. It is crucial for developers to remove this package and monitor their projects for vulnerabilities to maintain the integrity of their applications.
See every vulnerability recorded for female_angelfish_requirement →
FAQ
It is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores by publishing derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
The risks include unauthorized access to sensitive information, potential compromise of the npm registry, and pollution of the package ecosystem.
Regularly audit your dependencies, remove any suspicious packages, and use tools like Vulert to monitor for vulnerabilities.
Yes, by following best practices for dependency management, using trusted packages, and staying informed about security updates.
