Malicious Code Injection in lookingan-nakomi6 Package
Summary
MAL-2025-158412: Malicious code in lookingan-nakomi6 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lookingan-nakomi6 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development of applications by providing reusable code. However, it has been identified as part of a malicious campaign that exploits npm's publishing capabilities to inflate developer reputation scores through the creation of numerous derivative packages.
Vulnerability Detail
The vulnerability in the lookingan-nakomi6 package stems from its association with a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is designed to pollute the npm registry and can lead to the unintentional installation of compromised packages by developers. The malicious code can also create security risks by exposing applications to further vulnerabilities and attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lookingan-nakomi6If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the lookingan-nakomi6 package from your project by executing: npm uninstall lookingan-nakomi6. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities without needing to access the code directly.
Conclusion
The lookingan-nakomi6 package has been identified as containing malicious code that poses significant security risks. It is crucial for developers to take immediate action by updating or removing the package and utilizing monitoring tools like Vulert to safeguard their applications from potential vulnerabilities.
See every vulnerability recorded for lookingan-nakomi6 →
FAQ
The lookingan-nakomi6 package is an npm package used in JavaScript development, but it has been identified as part of a malicious campaign.
The malicious code can modify your package.json file, leading to the installation of compromised packages and exposing your application to security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed the lookingan-nakomi6 package, it is recommended to uninstall it immediately and check for any other affected packages.
To prevent future vulnerabilities, regularly update your packages, use tools like Vulert for monitoring, and review package dependencies carefully.
