Malicious Code Injection in kapvino-saaa-agada Package - npm Vulnerability
Summary
MAL-2025-157453: Malicious code in kapvino-saaa-agada (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kapvino-saaa-agada package is part of the npm ecosystem, often used for various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages are designed to manipulate developer reputation scores through automated publishing scripts.
Vulnerability Detail
The vulnerability in the kapvino-saaa-agada package originates from its involvement in a malicious campaign that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of these variants. This not only pollutes the npm registry but also poses a risk to developers who may unknowingly use these compromised packages, potentially leading to security breaches in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kapvino-saaa-agadaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by adding it to your project's .npmrc file with the following line: 'package-lock=false'. This will stop npm from installing any packages that are not explicitly defined in your package.json.
Conclusion
The kapvino-saaa-agada package presents a significant security risk due to its malicious code injection capabilities. It is crucial for developers to be vigilant and remove any instances of this package from their projects. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for kapvino-saaa-agada →
FAQ
The kapvino-saaa-agada package is an npm package associated with the tea.xyz token reward campaign, which has been identified as malicious.
This vulnerability can lead to the injection of malicious code into your application, potentially compromising its security and integrity.
You should uninstall the kapvino-saaa-agada package immediately and check for any dependencies that may be affected.
Yes, you can use Vulert, which monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
