Malicious Code Injection in irma-tempe22-breki: A Threat to npm Packages
Summary
MAL-2025-73555: Malicious code in irma-tempe22-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'irma-tempe22-breki' is part of a broader campaign that exploits the npm ecosystem. It is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This package, like others in the campaign, is designed to manipulate the npm registry by creating numerous variants with altered metadata.
Vulnerability Detail
The vulnerability in 'irma-tempe22-breki' stems from its malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is intended to flood the npm registry with these variants, which can lead to reputation inflation for the developers involved and potentially compromise the integrity of the npm ecosystem. The malicious payload can also facilitate the distribution of harmful packages under seemingly legitimate names.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall irma-tempe22-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the installation of this malicious package by using npm's package-lock.json file to monitor dependencies. Ensure that your project does not include 'irma-tempe22-breki' in its dependencies. You can also use tools like Vulert to monitor your project for vulnerabilities in real-time without needing to access the code directly.
Conclusion
The 'irma-tempe22-breki' package poses a significant threat due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be vigilant about their dependencies and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, such as uninstalling affected packages and regularly updating dependencies, developers can help maintain the integrity of their projects.
See every vulnerability recorded for irma-tempe22-breki →
FAQ
The vulnerability can lead to the proliferation of malicious packages in the npm registry, compromising the integrity of the ecosystem and potentially affecting other projects.
You can use Vulert to check your application for vulnerabilities by analyzing your package-lock.json file. Visit the Vulert playground at Vulert Scanner for a quick assessment.
Uninstall the package immediately using 'npm uninstall irma-tempe22-breki' and check your project for any other potentially harmful dependencies.
Yes, tools like Vulert can help monitor your project for open-source vulnerabilities in real-time, providing alerts without needing code access.
It is advisable to check for vulnerabilities regularly, especially after major updates or when adding new dependencies to your project.
