Malicious Code Injection in ill_wildfowl-silentdev Package
Summary
MAL-2025-103948: Malicious code in ill_wildfowl-silentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ill_wildfowl-silentdev package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate development by providing reusable code components. However, it has been identified as part of a malicious campaign that aims to manipulate the npm registry by generating and publishing numerous derivative packages with altered metadata.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the ill_wildfowl-silentdev package. This payload modifies the package.json file by removing private flags, altering version numbers, and creating random package names, which are often themed around Indonesian culture. The primary risk associated with this vulnerability is the potential for developers to unknowingly install these malicious packages, leading to compromised systems and polluted npm registries. The malicious scripts are designed to continuously republish variants, exacerbating the issue.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ill_wildfowl-silentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the ill_wildfowl-silentdev package and any other packages that may be part of the malicious campaign. Regularly audit your dependencies using tools like npm audit to identify and address vulnerabilities.
Conclusion
The ill_wildfowl-silentdev package poses a significant risk due to its malicious code that alters package metadata and repopulates the npm registry with harmful variants. It is essential for developers to be vigilant, regularly audit their dependencies, and utilize tools like Vulert to safeguard their projects.
See every vulnerability recorded for ill_wildfowl-silentdev →
FAQ
It is an npm package that has been identified as part of a malicious campaign aimed at manipulating the npm registry.
You can check your package-lock.json file for the presence of the ill_wildfowl-silentdev package. Additionally, using Vulert, you can monitor and alert for vulnerabilities in real-time.
You should uninstall the package immediately using the command npm uninstall ill_wildfowl-silentdev and check for any other affected packages.
Regularly audit your dependencies, keep your packages updated, and use tools like Vulert to monitor for vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
