Malicious Code Injection in inagi-vuma-nunbag Package
Summary
MAL-2025-156342: Malicious code in inagi-vuma-nunbag (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The inagi-vuma-nunbag package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is suspected to be involved in a token reward campaign that aims to manipulate developer reputation scores. It is designed to automatically generate and publish derivative packages, which can lead to pollution of the npm registry and potential security risks for users relying on this package.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the inagi-vuma-nunbag package. This code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. The primary risk is that it can lead to the proliferation of untrustworthy packages in the npm registry, which can compromise the integrity of applications that depend on these packages. The malicious payload can also inflate developer reputation scores fraudulently, undermining the trustworthiness of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall inagi-vuma-nunbagIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the inagi-vuma-nunbag package and monitor your project for any dependencies that may inadvertently include it. Regularly audit your package-lock.json file to identify and remove any malicious packages.
Conclusion
The inagi-vuma-nunbag package poses a significant risk due to its malicious code that alters package metadata and proliferates untrustworthy packages. Immediate action is required to remove this package and safeguard your application. Regular monitoring and auditing of dependencies are essential to maintain security.
See every vulnerability recorded for inagi-vuma-nunbag →
FAQ
The inagi-vuma-nunbag package is an npm package that has been identified as malicious, designed to manipulate developer reputation scores through the automatic generation of derivative packages.
This vulnerability can lead to the inclusion of untrustworthy packages in your application, potentially compromising its security and integrity.
You should uninstall the inagi-vuma-nunbag package immediately and check your project for any dependencies that may be affected.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground.
Regularly audit your dependencies, use trusted sources for packages, and consider implementing automated tools to monitor for vulnerabilities.
