Malicious Code Injection in lookingan-namala6 Package
Summary
MAL-2025-158773: Malicious code in lookingan-namala6 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lookingan-namala6 package is part of a series of npm packages that have been associated with the tea.xyz token reward campaign. These packages are designed to automatically generate and publish derivative packages with randomized names, which can inflate developer reputation scores for token rewards. The malicious nature of this package lies in its ability to modify critical files and republish itself under various names, leading to potential security risks for developers using it.
Vulnerability Detail
The vulnerability in the lookingan-namala6 package originates from its design to include autopublish scripts that manipulate the package.json file. This manipulation removes private flags, alters version numbers, and generates random package names, which can lead to the pollution of the npm registry. The ramifications include compromised developer environments, potential exposure of sensitive information, and the risk of malicious code being executed in applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lookingan-namala6If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the lookingan-namala6 package from your project by executing the command: npm uninstall lookingan-namala6. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The lookingan-namala6 package poses a significant security risk due to its malicious code that modifies essential files and republish variants. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for lookingan-namala6 →
FAQ
The lookingan-namala6 package is an npm package associated with a token reward campaign that generates and publishes derivative packages.
This vulnerability can lead to the execution of malicious code, modification of your package.json file, and pollution of the npm registry, potentially compromising your application's security.
You should immediately update or uninstall the package to mitigate the risks associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
You can find detailed information about this vulnerability in the Open Source Vulnerability database or by visiting the GitHub repository linked in the vulnerability report.
