Malicious Code Vulnerability in ida-saguer6-breki Package
Summary
MAL-2025-73452: Malicious code in ida-saguer6-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ida-saguer6-breki package is part of a series of npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify critical files and continuously republish variants, thereby polluting the npm registry.
Vulnerability Detail
This vulnerability originates from the package's design to include autopublish scripts that alter the package.json file by removing private flags and changing version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants. The ramifications of this vulnerability include the potential for developers to unknowingly install compromised packages, leading to security risks and a polluted npm registry.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ida-saguer6-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the ida-saguer6-breki package altogether. If it is a dependency of another package, consider removing that package or replacing it with a safer alternative. Additionally, you can monitor your project for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file for real-time alerts on open-source vulnerabilities.
Conclusion
The ida-saguer6-breki package poses a significant risk due to its malicious code designed to manipulate package metadata and republish variants. It is crucial for developers to be vigilant and remove any affected packages while utilizing tools like Vulert for ongoing monitoring.
See every vulnerability recorded for ida-saguer6-breki →
FAQ
The ida-saguer6-breki package is an npm package that is part of a malicious campaign to inflate developer reputation scores through automated publishing of derivative packages.
This vulnerability can lead to the installation of compromised packages, which may introduce security risks and clutter the npm registry with malicious variants.
You should uninstall the ida-saguer6-breki package immediately and monitor your project for any further vulnerabilities.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
