Malicious Code Injection in invisible_elephant_0xrequest Package
Summary
MAL-2025-104369: Malicious code in invisible_elephant_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The invisible_elephant_0xrequest package is part of the npm ecosystem, often utilized in various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with numerous packages. This package, like others in the campaign, is designed to manipulate npm's publishing mechanisms, potentially compromising the integrity of applications that depend on it.
Vulnerability Detail
The vulnerability in the invisible_elephant_0xrequest package stems from malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is part of a broader scheme to inflate developer reputation scores for token rewards, leading to the continuous republishing of variants that pollute the npm registry. The ramifications include the risk of unintentional inclusion of these malicious packages in projects, which can lead to security breaches and loss of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall invisible_elephant_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the invisible_elephant_0xrequest package and replace it with a trusted alternative that provides similar functionality. Always verify the integrity of packages before including them in your project.
Conclusion
The invisible_elephant_0xrequest package contains malicious code that poses a significant risk to applications using it. By understanding the nature of this vulnerability and taking appropriate actions, such as uninstalling the package and using trusted alternatives, developers can protect their projects from potential threats.
See every vulnerability recorded for invisible_elephant_0xrequest →
FAQ
The malicious code can lead to unauthorized changes in your project's package.json file, potentially compromising your application's security and integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your package-lock.json file to the Vulert playground, you can check for vulnerabilities without any signup.
If you have installed the invisible_elephant_0xrequest package, you should uninstall it immediately using the command: npm uninstall invisible_elephant_0xrequest.
Yes, you should look for trusted packages that offer similar functionality and have a good reputation in the community.
Regularly audit your dependencies, use tools like Vulert for monitoring, and only install packages from reputable sources.
