Malicious Code Injection in handicapped_rabbit_z3n Package
Summary
MAL-2025-94780: Malicious code in handicapped_rabbit_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The handicapped_rabbit_z3n package is part of the npm ecosystem, often used in JavaScript projects. It is associated with the tea.xyz token reward campaign, which has been linked to a series of malicious packages that flood the npm registry. These packages typically contain scripts designed to manipulate package metadata and inflate developer reputation scores, posing a significant risk to developers and their projects.
Vulnerability Detail
The vulnerability in the handicapped_rabbit_z3n package originates from its involvement in a malicious campaign that modifies the package.json file. This modification removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of variants that pollute the npm registry. The ramifications include potential security risks for developers who unknowingly use this package, as it can compromise their projects and reputations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall handicapped_rabbit_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the handicapped_rabbit_z3n package and monitor your project's dependencies for any malicious packages. You can also use tools like Vulert to check for vulnerabilities in your package-lock.json file.
Conclusion
The handicapped_rabbit_z3n package poses a significant security risk due to its malicious code that alters package metadata. It is crucial for developers to remove this package and monitor their projects for similar vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your applications.
See every vulnerability recorded for handicapped_rabbit_z3n →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, often used in JavaScript projects.
The vulnerability can lead to the modification of your package metadata, potentially compromising your project's integrity and security.
You should uninstall the handicapped_rabbit_z3n package immediately and check for any other affected packages in your project.
Yes, you can use Vulert to monitor your package-lock.json file for open-source vulnerabilities in real-time without needing to install any software.
Regularly audit your dependencies, use tools like Vulert, and stay updated on security advisories related to the packages you use.
