Malicious Code Vulnerability in kamasada-nuati-es Package
Summary
MAL-2025-157294: Malicious code in kamasada-nuati-es (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kamasada-nuati-es package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate token rewards for developers by generating and publishing derivative packages. However, it has been compromised to include malicious scripts that can affect the integrity of the npm registry.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the kamasada-nuati-es package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants, leading to pollution of the npm registry and potential misuse of developer reputation scores. This can result in developers unknowingly using compromised packages, which may lead to further security issues in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kamasada-nuati-esIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the kamasada-nuati-es package from your project by executing the command: npm uninstall kamasada-nuati-es. This will prevent any potential exploitation of the vulnerability until a secure version is released.
Conclusion
The kamasada-nuati-es package has been identified as containing malicious code that can compromise the integrity of the npm registry and affect developers' applications. It is essential to take immediate action by updating or removing the package to safeguard your projects.
See every vulnerability recorded for kamasada-nuati-es →
FAQ
The kamasada-nuati-es package is part of the npm ecosystem, designed to facilitate token rewards for developers through the tea.xyz campaign.
The malicious code modifies your package.json file and can lead to the installation of compromised packages, potentially introducing security vulnerabilities into your application.
If you have installed the kamasada-nuati-es package, it is crucial to uninstall it immediately and check for any updates or patches.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
More information can be found in the vulnerability report on the Open Source Vulnerability database and by checking the npm registry for updates.
