Malicious Code Injection in high_hookworm_z3n Package
Summary
MAL-2025-94822: Malicious code in high_hookworm_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The high_hookworm_z3n package is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to manipulate the npm registry by creating and publishing numerous derivative packages. Its primary functionality is to serve as a token reward mechanism, but it has been compromised to execute harmful scripts.
Vulnerability Detail
The vulnerability originates from the package being part of a malicious campaign associated with the tea.xyz token reward initiative. It contains scripts designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior leads to the continuous republishing of variants, which pollutes the npm registry and can inflate developer reputation scores fraudulently. The malicious payload poses significant risks, including potential security breaches and the degradation of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall high_hookworm_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the high_hookworm_z3n package and monitor your project for any dependencies that may have inadvertently included it. Regularly check your package-lock.json file for any suspicious entries. You can also utilize tools like Vulert to monitor and alert you in real-time for open-source vulnerabilities in your software.
Conclusion
The high_hookworm_z3n package poses a significant risk due to its malicious code designed to manipulate the npm registry. It is crucial to remove this package from your project and monitor your dependencies for any similar vulnerabilities. Utilizing tools like Vulert can help ensure your application remains secure.
See every vulnerability recorded for high_hookworm_z3n →
FAQ
The high_hookworm_z3n package is an npm package that has been identified as part of a malicious campaign to manipulate the npm registry.
This vulnerability can lead to the pollution of the npm registry, potential security breaches, and the inflation of developer reputation scores, which can harm the integrity of your application.
You should uninstall the high_hookworm_z3n package immediately using the command 'npm uninstall high_hookworm_z3n' and review your dependencies for any other malicious packages.
You can use Vulert, which monitors your package-lock.json to alert you in real-time for open-source vulnerabilities. You can also check your application using the Vulert playground without any signup.
There are no patches available for the high_hookworm_z3n package since it is recommended to remove it entirely from your project.
