Malicious Code Injection in linear_gorilla_cyan-62: npm Package Vulnerability
Summary
MAL-2025-105192: Malicious code in linear_gorilla_cyan-62 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linear_gorilla_cyan-62 package is part of a series of npm packages that have been associated with the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify critical files and republish itself, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in linear_gorilla_cyan-62 stems from its malicious payload that alters the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior is indicative of a broader scheme to manipulate the npm ecosystem for token rewards, leading to potential security risks for developers who may unknowingly use these compromised packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has flooded the npm registry with such malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall linear_gorilla_cyan-62If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the linear_gorilla_cyan-62 package altogether. If it is already in use, consider removing it from your package.json and running npm install to ensure that no malicious code is executed.
Conclusion
The linear_gorilla_cyan-62 package poses a significant risk due to its malicious code that alters project files and repopulates the npm registry with compromised packages. It is essential to remove this package and monitor your dependencies to maintain the security of your projects.
See every vulnerability recorded for linear_gorilla_cyan-62 →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, designed to inflate developer reputation scores.
The vulnerability can lead to unauthorized modifications in your project files and the potential for your application to be associated with malicious activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Remove the linear_gorilla_cyan-62 package from your project and ensure that you are using trusted packages.
Yes, tools like Vulert can help monitor your dependencies for vulnerabilities without requiring access to the code or installation.
