Malicious Code Injection in madrid-ucl-v Package
Summary
MAL-2025-159004: Malicious code in madrid-ucl-v (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The madrid-ucl-v package is part of the npm ecosystem and is used for various functionalities within JavaScript applications. However, it has been identified as part of a malicious campaign that floods the npm registry with derivative packages. This package is particularly vulnerable due to its association with scripts designed to manipulate package metadata and inflate developer reputation scores.
Vulnerability Detail
The vulnerability in the madrid-ucl-v package originates from its involvement in the tea.xyz token reward campaign. This campaign utilizes malicious scripts (such as auto.js and autopublish.js) that modify the package.json file by removing private flags, altering version numbers, and generating random package names. The continuous republishing of these variants leads to pollution of the npm registry, posing risks to developers and users who may unknowingly install these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall madrid-ucl-vIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the madrid-ucl-v package until a fixed version is released. Additionally, consider using a package-lock.json file to lock your dependencies to specific versions, preventing the installation of compromised packages.
Conclusion
The madrid-ucl-v package has been identified as containing malicious code that can compromise applications using it. It is essential to stay informed about such vulnerabilities and take proactive measures to secure your projects. Regular updates and monitoring tools like Vulert can help mitigate these risks.
See every vulnerability recorded for madrid-ucl-v →
FAQ
The madrid-ucl-v package is an npm package used in JavaScript applications, but it has been compromised by malicious actors.
The vulnerability can lead to the installation of malicious code that modifies your package metadata and potentially exposes your application to further risks.
You can use the Vulert platform to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert provides real-time alerts for any open-source vulnerabilities.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and avoid installing packages from untrusted sources.
If you have installed the madrid-ucl-v package, immediately remove it and update to a safe version if available. Use npm uninstall madrid-ucl-v to remove it.
