Malicious Code Injection in manaf-assin-muanst Package - npm Vulnerability
Summary
MAL-2025-159513: Malicious code in manaf-assin-muanst (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The manaf-assin-muanst package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The functionality of this package is compromised, as it contains scripts designed to manipulate package metadata and inflate developer reputation scores for token rewards.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the manaf-assin-muanst package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. The scripts included in the package (auto.js, autopublish.js, etc.) are designed to continuously republish these modified packages, leading to pollution of the npm registry and potential exploitation by attackers. This can result in unauthorized access to sensitive data or the execution of harmful code in dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall manaf-assin-muanstIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using the npm audit command to identify and remove any dependencies that may include it. Additionally, consider using a tool like Vulert to monitor your package-lock.json for vulnerabilities. You can check for affected packages in your application using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The manaf-assin-muanst package poses a significant risk due to its embedded malicious code, which can compromise the integrity of applications relying on it. It is crucial to remove this package and utilize tools like Vulert to ensure ongoing security against such vulnerabilities.
See every vulnerability recorded for manaf-assin-muanst →
FAQ
The manaf-assin-muanst package is an npm package associated with the tea.xyz token reward campaign, which has been identified as containing malicious code.
The malicious code modifies your package.json file, potentially leading to unauthorized access and execution of harmful scripts in your application.
You should uninstall the manaf-assin-muanst package immediately using the command npm uninstall manaf-assin-muanst.
You can use Vulert, which monitors your package-lock.json for vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Currently, there is no patched version of the manaf-assin-muanst package. The best course of action is to uninstall it and monitor for updates.
