Malicious Code Injection in maalasha-nut-pos Package
Summary
MAL-2025-158932: Malicious code in maalasha-nut-pos (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The maalasha-nut-pos package is part of the npm ecosystem, primarily used for point-of-sale applications. It is designed to facilitate transactions and manage sales data. However, this package has been identified as part of a malicious campaign that exploits npm's package publishing system, leading to significant security concerns.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the maalasha-nut-pos package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. It is part of a broader scheme to inflate developer reputation scores for token rewards, resulting in the continuous republishing of variants that pollute the npm registry. The ramifications include potential exposure of sensitive data, unauthorized access to systems, and a compromised development environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall maalasha-nut-posIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the maalasha-nut-pos package from your project and replace it with a trusted alternative until a secure version is released. Use the following command to uninstall the package: npm uninstall maalasha-nut-pos.
Conclusion
The maalasha-nut-pos package contains a serious vulnerability that can compromise your application and its data. It is crucial to take immediate action by updating or removing the package and monitoring your application for any signs of exploitation. Utilizing tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for maalasha-nut-pos →
FAQ
The maalasha-nut-pos package is an npm package used for point-of-sale applications, facilitating transaction management.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing your application to security risks and data breaches.
You should check the npm registry or the package's repository for any available patches or updates to the maalasha-nut-pos package.
Immediately update or uninstall the maalasha-nut-pos package and monitor your application for any unusual activity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
