Malicious Code Injection in iqbal-poke28: A Threat to npm Users
Summary
MAL-2025-156833: Malicious code in iqbal-poke28 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iqbal-poke28 is an npm package that has been identified as part of a malicious campaign targeting the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood the npm ecosystem with harmful packages. The primary function of iqbal-poke28 appears to be related to generating and publishing derivative packages that can inflate developer reputation scores for token rewards, making it a significant risk for developers using npm.
Vulnerability Detail
The vulnerability in iqbal-poke28 stems from its malicious code, which modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior leads to the continuous republishing of these variants, effectively polluting the npm registry. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which employs autopublish scripts to automate the creation of these harmful packages. The ramifications include potential security risks for developers who unknowingly install these packages, as well as the degradation of the npm ecosystem's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall iqbal-poke28If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using iqbal-poke28 and any other packages associated with the tea.xyz token reward campaign. Regularly audit your npm packages and use tools like Vulert to monitor for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The iqbal-poke28 package poses a significant threat to npm users due to its malicious code designed to manipulate package metadata and inflate developer reputation scores. It is crucial for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, developers can protect their projects from such threats.
See every vulnerability recorded for iqbal-poke28 →
FAQ
iqbal-poke28 is an npm package linked to a malicious campaign that aims to inflate developer reputation scores through the creation of harmful derivative packages.
The vulnerability can lead to the installation of malicious code that modifies your project's package.json, potentially compromising your application's security and integrity.
You can use tools like Vulert to scan your package-lock.json file for vulnerabilities, or manually check for the presence of iqbal-poke28 in your dependencies.
You should uninstall the package immediately using npm uninstall iqbal-poke28 and review your project for any other potentially harmful dependencies.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about known vulnerabilities in the npm ecosystem.
