Malicious Code Injection in homeless_cricket_0xrequest Package
Summary
MAL-2025-103759: Malicious code in homeless_cricket_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'homeless_cricket_0xrequest' package is part of a broader campaign associated with the tea.xyz token reward system, which has been known to flood the npm ecosystem with malicious packages. These packages are designed to manipulate npm's publishing system, often containing scripts that automatically generate and publish derivative packages with altered names and metadata. This behavior not only undermines the integrity of the npm registry but also poses significant risks to developers relying on these packages.
Vulnerability Detail
The vulnerability in the 'homeless_cricket_0xrequest' package originates from its inclusion in a malicious campaign that aims to inflate developer reputation scores through the automatic generation of numerous derivative packages. The malicious payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names, leading to pollution of the npm registry. This can result in developers inadvertently using compromised packages, exposing their applications to potential security risks and instability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall homeless_cricket_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'homeless_cricket_0xrequest' package and replace it with a trusted alternative that provides similar functionality. Additionally, consider using tools like Vulert to monitor your package dependencies for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The 'homeless_cricket_0xrequest' package poses a significant security risk due to its malicious code designed to manipulate npm's publishing system. It is crucial for developers to remove this package from their projects and monitor their dependencies for vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your applications.
See every vulnerability recorded for homeless_cricket_0xrequest →
FAQ
It is a malicious npm package associated with a token reward campaign that manipulates the npm registry.
Using this package can expose your application to security risks and instability due to its malicious behavior.
You should uninstall the package immediately using 'npm uninstall homeless_cricket_0xrequest' and check for any affected dependencies.
Yes, tools like Vulert can monitor your package-lock.json for vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
