Malicious Code Injection in general_aphid_dumbs Package: A Threat to npm Ecosystem
Summary
MAL-2025-103076: Malicious code in general_aphid_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The general_aphid_dumbs package is part of a malicious campaign targeting the npm ecosystem, primarily associated with the tea.xyz token reward initiative. This package is designed to manipulate npm's publishing system, generating numerous derivative packages with randomized names to artificially inflate developer reputation scores. The malicious nature of this package poses a significant risk to developers and users relying on npm for package management.
Vulnerability Detail
The vulnerability in the general_aphid_dumbs package originates from its design to execute autopublish scripts that modify the package.json file. This modification removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of variants that pollute the npm registry. The ramifications include potential security risks for applications using these packages, as they may inadvertently incorporate malicious code into their dependencies.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall general_aphid_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the general_aphid_dumbs package and monitor your project's dependencies for any instances of this malicious package. You can also use tools like Vulert to scan your package-lock.json for vulnerabilities.
Conclusion
The general_aphid_dumbs package poses a significant threat to the npm ecosystem due to its malicious code injection capabilities. It is crucial for developers to be vigilant, regularly audit their dependencies, and utilize tools like Vulert to ensure their applications remain secure from such vulnerabilities.
See every vulnerability recorded for general_aphid_dumbs →
FAQ
The general_aphid_dumbs package is a malicious npm package designed to manipulate the npm registry by generating derivative packages with random names.
This vulnerability can lead to the inclusion of malicious code in your application, potentially compromising its security and functionality.
You should uninstall the general_aphid_dumbs package immediately and monitor your dependencies for any related vulnerabilities.
Yes, regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in real-time.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
