Malicious Code Injection in lookingan-namalaka65 Package
Summary
MAL-2025-158879: Malicious code in lookingan-namalaka65 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The lookingan-namalaka65 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development of applications by providing reusable code. However, it has been identified as part of a malicious campaign that aims to exploit the npm registry by flooding it with derivative packages that can harm developers' reputations and the integrity of the registry itself.
Vulnerability Detail
The vulnerability in the lookingan-namalaka65 package originates from its association with the tea.xyz token reward campaign. This package contains malicious scripts that automatically modify the package.json file to remove private flags, change version numbers, and generate random package names. The scripts continuously republish these variants, polluting the npm registry and potentially compromising the security of applications that depend on these packages. The ramifications include loss of control over package integrity and increased risk of dependency confusion attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lookingan-namalaka65If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the lookingan-namalaka65 package and any other packages associated with the tea.xyz campaign. Regularly audit your dependencies using tools like npm audit to identify and mitigate vulnerabilities.
Conclusion
The lookingan-namalaka65 package poses a significant security risk due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be vigilant about the packages they use and to regularly audit their dependencies. By removing this package and utilizing tools like Vulert, developers can better protect their applications from potential threats.
See every vulnerability recorded for lookingan-namalaka65 →
FAQ
The lookingan-namalaka65 package is an npm package that has been identified as part of a malicious campaign to flood the npm registry with harmful derivative packages.
The malicious code can modify your package.json file, remove private flags, and republish variants, leading to potential security risks and loss of control over your dependencies.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed the lookingan-namalaka65 package, you should uninstall it immediately using 'npm uninstall lookingan-namalaka65' and review your other dependencies for similar vulnerabilities.
Yes, tools like npm audit and Vulert can help you identify and manage vulnerabilities in your dependencies effectively.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
