Malicious Code Injection in guilhermecosta Package: npm Vulnerability Summary
Summary
MAL-2025-171281: Malicious code in guilhermecosta (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The guilhermecosta package is part of the npm ecosystem, primarily used for JavaScript development. It is often utilized by developers to manage dependencies and facilitate package distribution. However, this package has been identified as part of a malicious campaign that exploits npm's publishing capabilities, leading to potential security risks for users and their applications.
Vulnerability Detail
The vulnerability originates from the guilhermecosta package, which is linked to a broader malicious campaign involving the tea.xyz token reward initiative. This package contains scripts designed to automatically generate and publish derivative packages with randomized names, effectively polluting the npm registry. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and continuously republishing variants, which can lead to reputation inflation and potential security breaches for developers who unknowingly use these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall guilhermecostaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the guilhermecosta package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities.
Conclusion
The guilhermecosta package poses a significant security risk due to its malicious code that modifies package configurations and repopulates the npm registry with harmful variants. It is crucial for developers to remove this package and monitor their dependencies to maintain application security.
See every vulnerability recorded for guilhermecosta →
FAQ
The guilhermecosta package is an npm package used in JavaScript development, but it has been identified as part of a malicious campaign.
The malicious code can modify your package.json file, remove private flags, and republish variants, potentially leading to security vulnerabilities and reputation inflation.
You should uninstall the guilhermecosta package immediately using 'npm uninstall guilhermecosta' and monitor your dependencies for any further vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software, using just your package-lock.json file.
