Malicious Code Injection in joko-tek48-riris Package
Summary
MAL-2025-97983: Malicious code in joko-tek48-riris (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The joko-tek48-riris package is part of the npm ecosystem, which is widely used for JavaScript development. This package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the creation of derivative packages. Its functionality is compromised, making it a vector for malicious activities.
Vulnerability Detail
The vulnerability originates from the package being associated with the tea.xyz token reward campaign, which floods the npm registry with malicious packages. These packages contain scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. The continuous republishing of these variants leads to pollution of the npm registry and can compromise the integrity of applications relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall joko-tek48-ririsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the joko-tek48-riris package and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your package dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Conclusion
The joko-tek48-riris package poses a significant risk due to its malicious code that alters project files and contributes to npm registry pollution. Immediate action is required to remove this package and monitor for any vulnerabilities in your project. Utilizing tools like Vulert can enhance your security posture.
See every vulnerability recorded for joko-tek48-riris →
FAQ
The package contains malicious code that modifies project files and floods the npm registry with derivative packages.
You can use Vulert's playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
You should uninstall the package immediately using 'npm uninstall joko-tek48-riris' and check for any alternative packages.
Yes, tools like Vulert can help monitor your dependencies for vulnerabilities in real-time.
While removing the package itself should not cause data loss, ensure that you have backups and check your project for any dependencies that may rely on it.
