Malicious Code Injection in iwan-mieaceh2-breki Package
Summary
MAL-2025-73584: Malicious code in iwan-mieaceh2-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iwan-mieaceh2-breki package is part of the npm ecosystem, often used in JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. This package, like others in the campaign, is designed to manipulate the npm registry for fraudulent purposes, impacting developers and users alike.
Vulnerability Detail
The vulnerability in the iwan-mieaceh2-breki package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, which are then republished to the npm registry. This behavior not only pollutes the registry but also poses a risk to developers who may unknowingly use these compromised packages, potentially leading to security breaches and loss of reputation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall iwan-mieaceh2-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the iwan-mieaceh2-breki package altogether. If it is already in use, consider replacing it with a reputable alternative that does not exhibit malicious behavior. Additionally, regularly audit your dependencies using tools like npm audit to identify and mitigate vulnerabilities.
Conclusion
The iwan-mieaceh2-breki package contains malicious code that poses significant risks to developers and their projects. It is crucial to remove this package and monitor your dependencies for vulnerabilities. Utilizing tools like Vulert can enhance your security posture by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for iwan-mieaceh2-breki →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, known for containing malicious code.
The code modifies your package.json file, removes private flags, and republishes variants, which can lead to security vulnerabilities.
You can use Vulert to monitor and alert for vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
Remove the iwan-mieaceh2-breki package from your project and consider using a secure alternative.
Yes, tools like npm audit and Vulert can help you identify and manage vulnerabilities in your dependencies.
