Malicious Code Injection in lina-poke73: A Threat to npm Users
Summary
MAL-2025-158160: Malicious code in lina-poke73 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lina-poke73 is an npm package that appears to be part of a broader malicious campaign targeting developers through the tea.xyz token reward system. This package is designed to automatically generate and publish derivative packages with randomized names, aiming to inflate developer reputation scores for token rewards. The malicious nature of this package compromises the integrity of the npm registry and can lead to significant security risks for users.
Vulnerability Detail
The vulnerability in lina-poke73 stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior allows the package to continuously republish variants, polluting the npm registry and potentially leading to the installation of compromised packages by unsuspecting developers. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which exploits npm's publishing mechanisms.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lina-poke73If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the lina-poke73 package and monitor your project for any unauthorized changes. Additionally, consider using tools like Vulert to scan your package-lock.json for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The lina-poke73 package poses a significant threat to npm users due to its malicious behavior and association with a broader exploitation campaign. It is crucial to remove this package and monitor your dependencies to maintain the security of your projects. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities effectively.
See every vulnerability recorded for lina-poke73 →
FAQ
lina-poke73 is an npm package that has been identified as part of a malicious campaign aimed at exploiting the npm registry.
The vulnerability can lead to the installation of compromised packages, which may introduce security risks and affect the integrity of your project.
You should remove the lina-poke73 package from your project immediately and monitor for any unauthorized changes.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay updated on security advisories related to your packages.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
