Malicious Code Injection in Inherent Possum Dumbs Package
Summary
MAL-2025-104198: Malicious code in inherent_possum_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'inherent_possum_dumbs' package is part of the npm ecosystem and has been identified as a component of the tea.xyz token reward campaign. This package is designed to facilitate the automatic generation and publication of derivative packages, which are often used to inflate developer reputation scores for token rewards. Its functionality includes creating randomized package names and modifying existing package metadata.
Vulnerability Detail
The vulnerability in the 'inherent_possum_dumbs' package stems from its malicious payload that alters the package.json file by removing private flags, changing version numbers, and generating random Indonesian-themed package names. This behavior leads to the continuous republishing of variants, which pollutes the npm registry and can compromise the integrity of the ecosystem. The origin of this issue is linked to the package's involvement in a broader scheme to exploit npm for token rewards, making it a significant concern for developers relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall inherent_possum_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'inherent_possum_dumbs' package from your project by executing 'npm uninstall inherent_possum_dumbs'. This will prevent any malicious activity associated with the package until a secure version is available.
Conclusion
The 'inherent_possum_dumbs' package poses a significant risk due to its malicious code that alters package metadata and repopulates the npm registry with potentially harmful variants. It is crucial for developers to take immediate action by updating or removing this package to safeguard their projects.
See every vulnerability recorded for inherent_possum_dumbs →
FAQ
It is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through automated package publishing.
The vulnerability can lead to the pollution of the npm registry and may compromise the integrity of your project's dependencies, potentially introducing other security risks.
You should check the npm registry for any updated versions of the 'inherent_possum_dumbs' package that may address this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
