Malicious Code Injection in manda-42: A Threat to npm Ecosystem
Summary
MAL-2025-159640: Malicious code in manda-42 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
manda-42 is an npm package that is part of a broader campaign to exploit the npm ecosystem. It is designed to facilitate the tea.xyz token reward system, which incentivizes developers through token rewards. However, this package has been identified as malicious, containing scripts that manipulate package metadata and flood the npm registry with harmful variants.
Vulnerability Detail
The vulnerability in manda-42 stems from its inclusion in a malicious campaign that utilizes autopublish scripts to modify package.json files. These scripts remove private flags, alter version numbers, and generate random package names, ultimately leading to the pollution of the npm registry. The origin of this issue is linked to the tea.xyz token reward campaign, which aims to inflate developer reputation scores through deceptive practices.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall manda-42If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the manda-42 package and monitor your project for any dependencies that may inadvertently include it. Regularly audit your dependencies using tools like npm audit to identify and address vulnerabilities.
Conclusion
The manda-42 package poses a significant threat to the npm ecosystem due to its malicious code that modifies package metadata and floods the registry. It is essential to remove this package from your project and monitor your dependencies to ensure the security of your applications.
See every vulnerability recorded for manda-42 →
FAQ
The manda-42 vulnerability can lead to the modification of your project's package.json file, potentially exposing your project to further risks and pollution of the npm registry.
You can use Vulert to monitor your project for vulnerabilities. By analyzing your package-lock.json file, Vulert provides real-time alerts for open-source vulnerabilities.
To prevent similar vulnerabilities, regularly audit your dependencies, avoid using unverified packages, and utilize tools like Vulert for real-time monitoring.
If you have installed manda-42, immediately uninstall it using npm uninstall manda-42 and check your project for any other affected packages.
Yes, you can use npm safely by being cautious about the packages you install, regularly auditing your dependencies, and utilizing tools like Vulert to stay informed about vulnerabilities.
