Malicious Code Injection in inal-poke35: A Threat to npm Ecosystem
Summary
MAL-2025-156421: Malicious code in inal-poke35 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'inal-poke35' is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign aimed at exploiting the npm registry by flooding it with derivative packages. These packages are designed to inflate developer reputation scores through automated scripts that generate and publish numerous variants with random names.
Vulnerability Detail
The vulnerability in 'inal-poke35' originates from its involvement in a token reward campaign that utilizes autopublish scripts to modify the package.json file. This modification removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of malicious variants. The ramifications include potential pollution of the npm registry, increased risk of dependency confusion, and exploitation of developers' trust in the ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall inal-poke35If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using 'inal-poke35' and monitor your project for any dependencies that may inadvertently include it. Additionally, consider using tools like Vulert to scan your package-lock.json for vulnerabilities.
Conclusion
The 'inal-poke35' package presents a significant risk due to its malicious code that alters package.json files and floods the npm registry with harmful variants. It is crucial for developers to be vigilant, remove affected packages, and utilize tools like Vulert to maintain the integrity of their projects.
See every vulnerability recorded for inal-poke35 →
FAQ
The primary threat is the injection of malicious code that modifies package.json files, leading to the creation of numerous harmful package variants.
You can use Vulert to monitor your package-lock.json for vulnerabilities. The Vulert playground allows you to check for affected packages without requiring any signup.
If you have installed inal-poke35, it is advisable to remove it immediately and check for any other dependencies that may be affected.
While specific exploits have not been detailed, the vulnerability allows for the potential manipulation of the npm registry, which could lead to broader security issues.
Regularly audit your dependencies using tools like Vulert, keep your packages updated, and be cautious of packages that are part of token reward schemes or have suspicious activity.
