Malicious Code Injection in lookingan-konami98 Package
Summary
MAL-2025-158364: Malicious code in lookingan-konami98 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lookingan-konami98 package is part of a series of npm packages that have been identified as malicious. These packages are often associated with the tea.xyz token reward campaign, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of this package lies in its ability to modify critical files and republish itself under various names, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in the lookingan-konami98 package originates from its design to include autopublish scripts that manipulate the package.json file. This manipulation removes private flags, alters version numbers, and generates random package names, which can lead to significant security risks. The continuous republishing of these variants can clutter the npm registry, making it difficult for developers to find legitimate packages and potentially exposing them to further malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lookingan-konami98If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your project's dependencies using tools like Vulert. Vulert allows you to check for vulnerabilities in your package-lock.json file without requiring installation. You can use the Vulert playground at https://vulert.com/scanner to assess if your application is affected by this vulnerability.
Conclusion
The lookingan-konami98 package poses a significant security risk due to its malicious code designed to manipulate package files and republish itself. It is crucial for developers to remove this package and utilize tools like Vulert to monitor their dependencies for vulnerabilities.
See every vulnerability recorded for lookingan-konami98 →
FAQ
The lookingan-konami98 package is a malicious npm package associated with the tea.xyz token reward campaign, designed to inflate developer reputation scores.
This vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing your project to further security risks and cluttering the npm registry.
You should uninstall the lookingan-konami98 package immediately using 'npm uninstall lookingan-konami98' and monitor your dependencies for any other vulnerabilities.
It is advisable to be cautious with packages from the same source, as they may also contain malicious code. Always verify the integrity and reputation of packages before installation.
You can use tools like Vulert to monitor your package-lock.json file for vulnerabilities in real-time without needing to install any software.
