Malicious Code Injection in html-webpack-plugin-zenobia-nebula-antares Package
Summary
MAL-2025-187381: Malicious code in html-webpack-plugin-zenobia-nebula-antares (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The html-webpack-plugin-zenobia-nebula-antares package is a variant of the html-webpack-plugin, commonly used in web development to simplify the creation of HTML files for webpack bundles. This package, however, has been identified as part of a malicious campaign that floods the npm registry with harmful packages. It is designed to manipulate package metadata and publish derivative packages, potentially compromising the integrity of projects that depend on it.
Vulnerability Detail
The vulnerability originates from the package being part of the tea.xyz token reward campaign, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious code modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior can lead to pollution of the npm registry, making it difficult for developers to find legitimate packages and potentially introducing security risks into their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall html-webpack-plugin-zenobia-nebula-antaresIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using this package and look for alternative packages that provide similar functionality without the associated risks. Additionally, ensure that your package-lock.json file is monitored for any unauthorized changes.
Conclusion
The html-webpack-plugin-zenobia-nebula-antares package poses significant risks due to its malicious code designed to manipulate package metadata and publish harmful derivatives. It is crucial for developers to remove this package from their projects and monitor for any unauthorized changes. Utilizing tools like Vulert can help in maintaining the security of your applications.
See every vulnerability recorded for html-webpack-plugin-zenobia-nebula-antares →
FAQ
It is a variant of the html-webpack-plugin used in web development, but it has been identified as malicious.
It can lead to the pollution of the npm registry and introduce security risks by modifying your package metadata.
You should uninstall the package immediately and monitor your project for any unauthorized changes.
Yes, consider using other reputable packages that provide similar functionality without the malicious behavior.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access.
