Malicious Code Injection in layla-poke38: A Threat to npm Ecosystem
Summary
MAL-2025-158022: Malicious code in layla-poke38 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
layla-poke38 is an npm package that is part of a larger ecosystem of packages often used for token reward campaigns. These packages are designed to enhance developer reputation through the automatic generation and publication of derivative packages. However, the presence of malicious code in layla-poke38 poses a significant risk to users and the integrity of the npm registry.
Vulnerability Detail
The vulnerability in layla-poke38 originates from its association with the tea.xyz token reward campaign, which has led to the proliferation of malicious packages on npm. The malicious code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, ultimately leading to the pollution of the npm registry. This can result in compromised developer accounts and the distribution of harmful software to end users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall layla-poke38If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the layla-poke38 package until a secure version is released. Additionally, consider using the following command to uninstall the package: 'npm uninstall layla-poke38'.
Conclusion
The layla-poke38 package has been identified as containing malicious code that poses a significant risk to the npm ecosystem. Users are advised to take immediate action to mitigate this vulnerability by updating or uninstalling the package and utilizing monitoring tools like Vulert to safeguard their projects.
See every vulnerability recorded for layla-poke38 →
FAQ
layla-poke38 is an npm package that is part of a token reward campaign, which has been found to contain malicious code.
The malicious code can modify your project's package.json, remove private flags, and lead to the publication of harmful packages, compromising your project's integrity.
If you have installed layla-poke38, you should uninstall it immediately and monitor your project for any unauthorized changes.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json. You can check your application for vulnerabilities without signup at Vulert Playground.
To prevent future vulnerabilities, regularly audit your dependencies, keep them updated, and utilize tools like Vulert to monitor for potential threats.
