Malicious Code Injection in iwan-pecel5-ruro: A Threat to npm Ecosystem
Summary
MAL-2025-104472: Malicious code in iwan-pecel5-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iwan-pecel5-ruro is an npm package that has been identified as part of a malicious campaign targeting the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood the npm ecosystem with harmful packages. The primary functionality of this package is to serve as a token reward mechanism, but it has been compromised to include malicious scripts that can affect developers and their projects.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the iwan-pecel5-ruro package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes variants of the package, leading to pollution of the npm registry and potentially damaging the reputation of developers who inadvertently use these packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which employs autopublish scripts to inflate developer reputation scores.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall iwan-pecel5-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the iwan-pecel5-ruro package altogether and look for alternative packages that provide similar functionality without the associated risks.
Conclusion
The iwan-pecel5-ruro package poses a significant threat to the npm ecosystem due to its malicious code that modifies package metadata and repopulates the registry with harmful variants. It is crucial for developers to remove this package and monitor their projects for vulnerabilities using tools like Vulert.
See every vulnerability recorded for iwan-pecel5-ruro →
FAQ
iwan-pecel5-ruro is an npm package linked to a malicious campaign that modifies package metadata and floods the npm registry with harmful variants.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities. Visit Vulert Scanner to check your application without needing to sign up.
Using the iwan-pecel5-ruro package can lead to the exposure of your project to malicious scripts, which may compromise your code integrity and developer reputation.
Regularly audit your dependencies and utilize tools like Vulert to monitor for vulnerabilities in real-time.
Immediately uninstall the package and check your project for any unintended changes made by the malicious code.
