Malicious Code Injection in intan-81 Package: A Threat to npm Ecosystem
Summary
MAL-2025-156595: Malicious code in intan-81 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intan-81 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary function of such packages is to manipulate the npm registry by creating and publishing derivative packages, thereby inflating developer reputation scores for token rewards.
Vulnerability Detail
The vulnerability in the intan-81 package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. The malicious payload continuously republishes these variants, leading to pollution of the npm registry and potential exploitation by malicious actors. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which employs these tactics to manipulate the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall intan-81If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily avoid using the intan-81 package by removing it from your dependencies. Additionally, you can monitor your project's package-lock.json file for any unauthorized changes or additions.
Conclusion
The intan-81 package poses a significant threat to the npm ecosystem due to its malicious code that manipulates package metadata and floods the registry with unauthorized variants. It is crucial for developers to remove this package and monitor their projects for vulnerabilities to maintain security.
See every vulnerability recorded for intan-81 →
FAQ
The intan-81 package is an npm package associated with a token reward campaign that has been found to contain malicious code.
The malicious code modifies your package.json file, removes private flags, and publishes unauthorized variants, potentially leading to security vulnerabilities.
You should remove the intan-81 package from your project immediately and monitor your package-lock.json for any changes.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without signing up.
Regularly audit your dependencies, use tools like Vulert to monitor vulnerabilities, and ensure you are using trusted packages from reputable sources.
