Malicious Code Vulnerability in lina-enting7-riris Package
Summary
MAL-2025-87798: Malicious code in lina-enting7-riris (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lina-enting7-riris package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate the automatic generation and publication of derivative packages, which can inflate developer reputation scores for token rewards. However, it has been identified as containing malicious code that compromises its integrity and the security of the npm registry.
Vulnerability Detail
The vulnerability in the lina-enting7-riris package originates from its malicious payload, which modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to security risks, including the potential for developers to unknowingly install compromised packages, thereby exposing their applications to further vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lina-enting7-ririsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the lina-enting7-riris package from your project by executing the command: npm uninstall lina-enting7-riris. This will prevent any malicious code from executing in your application until a secure version is available.
Conclusion
The lina-enting7-riris package has been identified as containing malicious code that poses a significant security risk to applications using it. It is crucial to take immediate action by updating or uninstalling the package to protect your application from potential exploitation.
See every vulnerability recorded for lina-enting7-riris →
FAQ
The lina-enting7-riris package is an npm package associated with the tea.xyz token reward campaign, designed to automate the generation of derivative packages.
The vulnerability can lead to the installation of compromised packages, exposing your application to security risks and potentially allowing malicious actors to manipulate your code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. Check your application at Vulert Scanner without any signup.
If you cannot update the package, it is advisable to uninstall it temporarily to mitigate the risk of exploitation until a secure version is released.
You can find more information about vulnerabilities in npm packages on platforms like Vulert, which provides real-time monitoring and alerts for open-source vulnerabilities.
