Malicious Code Injection in jurss-zas-durss Package - npm Vulnerability
Summary
MAL-2025-157226: Malicious code in jurss-zas-durss (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jurss-zas-durss package is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to exploit the npm registry by flooding it with derivative packages. These packages are designed to inflate developer reputation scores for token rewards associated with the tea.xyz protocol. The malicious nature of this package lies in its ability to modify essential files and continuously republish variants, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the jurss-zas-durss package. It includes scripts that automatically generate and publish derivative packages with randomized names, effectively removing private flags from package.json files and altering version numbers. This behavior can lead to significant ramifications, including the compromise of the npm registry's integrity and the potential for developers to unknowingly install compromised packages. The malicious payload is designed to operate continuously, making it difficult to detect and remove.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall jurss-zas-durssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can prevent the installation of this package by using the following command to uninstall it: npm uninstall jurss-zas-durss. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities in real-time.
Conclusion
The jurss-zas-durss package poses a significant security risk due to its malicious code that modifies essential files and floods the npm registry. Immediate action is required to remove this package from your project to ensure the integrity and security of your software. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for jurss-zas-durss →
FAQ
The jurss-zas-durss package is an npm package that has been identified as part of a malicious campaign to exploit the npm registry.
This vulnerability can compromise the integrity of your project by allowing malicious code to be executed, potentially leading to security breaches.
You should immediately uninstall the jurss-zas-durss package from your project to mitigate any risks associated with this vulnerability.
Currently, there is no patched version available for the jurss-zas-durss package, so removal is the best course of action.
You can use Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access or installation.
