Malicious Code Injection in maximum_cricket_z3n: A Threat to npm Ecosystem
Summary
MAL-2025-105673: Malicious code in maximum_cricket_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'maximum_cricket_z3n' is part of a series of npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The functionality of this package is compromised due to the presence of malicious code that modifies essential files, leading to potential security risks.
Vulnerability Detail
The vulnerability in 'maximum_cricket_z3n' originates from its association with a malicious campaign that floods the npm registry with derivative packages. The malicious payload alters the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior can lead to the pollution of the npm registry, making it difficult for developers to trust legitimate packages and potentially exposing applications to further vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall maximum_cricket_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'maximum_cricket_z3n' package from your project by executing: 'npm uninstall maximum_cricket_z3n'. This action will prevent any malicious code from executing until a secure version is available.
Conclusion
The 'maximum_cricket_z3n' package poses a significant threat due to its malicious code that alters essential files and pollutes the npm registry. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for maximum_cricket_z3n →
FAQ
The malicious code modifies the package.json file to remove private flags and changes version numbers, which can lead to the creation of numerous derivative packages that pollute the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
Using this package can lead to security risks such as exposure to malicious code, potential data breaches, and the pollution of the npm registry, making it difficult to trust other packages.
To prevent similar vulnerabilities, always audit your dependencies, use trusted sources for packages, and regularly update your packages to their latest secure versions.
If an immediate update is not possible, consider removing the package from your project as a temporary measure until a secure version is available.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
