Malicious Code Injection in kuinsu-luki-nsubi: A Threat to npm Users
Summary
MAL-2025-157766: Malicious code in kuinsu-luki-nsubi (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kuinsu-luki-nsubi package is part of a broader ecosystem within npm, often associated with token reward campaigns. These packages are designed to manipulate npm's publishing system, generating numerous derivative packages with randomized names. This behavior not only inflates developer reputation scores but also poses a significant risk to users who may unknowingly install these malicious packages.
Vulnerability Detail
The vulnerability in kuinsu-luki-nsubi originates from its association with the tea.xyz token reward campaign. The package contains scripts that automatically modify the package.json file, removing private flags and changing version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes variants to pollute the npm registry. This malicious activity can lead to compromised systems and unintentional exposure to harmful code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kuinsu-luki-nsubiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the kuinsu-luki-nsubi package and monitor your project for any unintended installations. You can also use tools like Vulert to check for vulnerabilities in your package-lock.json file. For example, you can visit the Vulert playground at https://vulert.com/scanner to see if your application is affected by this vulnerability without needing to sign up.
Conclusion
The kuinsu-luki-nsubi package poses a significant threat due to its malicious code injection capabilities. Users are advised to uninstall the package and monitor their projects for vulnerabilities. Utilizing tools like Vulert can help maintain the integrity of your applications.
See every vulnerability recorded for kuinsu-luki-nsubi →
FAQ
kuinsu-luki-nsubi is an npm package that is part of a token reward campaign, often associated with malicious activities aimed at manipulating npm's publishing system.
The vulnerability can lead to the installation of malicious code, which may compromise your application and expose sensitive data.
You should uninstall the package immediately using 'npm uninstall kuinsu-luki-nsubi' and check your project for any other potentially harmful packages.
Yes, you can use Vulert to monitor your package-lock.json file for real-time alerts on open-source vulnerabilities.
Absolutely! You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
