Malicious Code Injection in madan-poke48: A Threat to npm Users
Summary
MAL-2025-158987: Malicious code in madan-poke48 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The madan-poke48 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and deployment of applications by providing reusable code. However, it has been identified as part of a malicious campaign that targets developers by flooding the npm registry with harmful packages designed to manipulate developer reputation scores.
Vulnerability Detail
The vulnerability in madan-poke48 originates from its association with the tea.xyz token reward campaign, which has been linked to the distribution of malicious packages on npm. These packages contain scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. The continuous republishing of these variants leads to pollution of the npm registry, potentially compromising the integrity of the ecosystem and affecting developers' projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall madan-poke48If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily avoid using madan-poke48 and any other packages associated with the tea.xyz campaign. Regularly audit your dependencies using tools like npm audit to identify and mitigate risks from malicious packages.
Conclusion
The madan-poke48 package poses a significant threat to npm users due to its malicious code designed to manipulate package metadata and inflate developer reputation scores. It is crucial for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for madan-poke48 →
FAQ
Madan-poke48 is an npm package that has been identified as part of a malicious campaign aimed at manipulating developer reputation scores.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially compromising your project's integrity and security.
You should remove the madan-poke48 package from your project immediately and check for any other potentially malicious packages.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
