Malicious Code Injection in manud-nofty-muatu Package: A Threat to npm Ecosystem
Summary
MAL-2025-159989: Malicious code in manud-nofty-muatu (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The manud-nofty-muatu package is part of the npm ecosystem, which is widely used for managing JavaScript packages. This package is associated with the tea.xyz token reward campaign, which has been linked to a series of malicious activities aimed at inflating developer reputation scores. The package's functionality is compromised by the inclusion of scripts that automatically generate and publish derivative packages, leading to pollution of the npm registry.
Vulnerability Detail
The vulnerability in the manud-nofty-muatu package stems from its malicious payload that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. This behavior not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly use these tainted packages. The origin of this vulnerability is traced back to the tea.xyz token reward campaign, which exploits the npm ecosystem for malicious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall manud-nofty-muatuIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the manud-nofty-muatu package from your project by executing 'npm uninstall manud-nofty-muatu'. This will prevent any malicious code from executing while you seek a secure alternative package.
Conclusion
The manud-nofty-muatu package poses a significant threat to the npm ecosystem due to its malicious code that alters package metadata and floods the registry with compromised packages. It is crucial for developers to take immediate action by updating or removing the package and to implement monitoring tools like Vulert to safeguard their projects against future vulnerabilities.
See every vulnerability recorded for manud-nofty-muatu →
FAQ
manud-nofty-muatu is an npm package that has been associated with malicious activities aimed at inflating developer reputation scores through automated publishing of derivative packages.
This vulnerability can lead to the pollution of the npm registry and may expose your project to malicious code, affecting its security and integrity.
If you have installed the manud-nofty-muatu package, it is recommended to uninstall it immediately and check for any updates or patches for your other dependencies.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
To prevent similar vulnerabilities, regularly audit your dependencies, keep them updated, and utilize tools like Vulert to monitor for vulnerabilities in real-time.
