Malicious Code Injection in maya-rangi96-ruro Package
Summary
MAL-2025-105709: Malicious code in maya-rangi96-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The maya-rangi96-ruro package is part of the npm ecosystem, which is widely used for JavaScript package management. This package was identified as part of a campaign that exploits npm's publishing capabilities to generate and distribute malicious packages. Its primary function is to serve as a token reward mechanism, but it has been compromised to inflate developer reputation scores through automated scripts.
Vulnerability Detail
The vulnerability in the maya-rangi96-ruro package stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags and alter version numbers. This allows the package to generate numerous derivative packages with randomized names, which are then continuously republished to pollute the npm registry. The malicious payload can lead to security risks for developers who unknowingly integrate these compromised packages into their projects, potentially exposing them to further attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall maya-rangi96-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the maya-rangi96-ruro package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using tools like Vulert to monitor your package dependencies for vulnerabilities.
Conclusion
The maya-rangi96-ruro package has been identified as a vector for malicious code injection, posing significant risks to developers and their projects. It is essential to remove this package and monitor for vulnerabilities to maintain the integrity of your software.
See every vulnerability recorded for maya-rangi96-ruro →
FAQ
The maya-rangi96-ruro package is an npm package that was part of a malicious campaign aimed at inflating developer reputation scores through automated publishing.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising security and functionality.
If you have installed the maya-rangi96-ruro package, it is crucial to remove it from your project immediately and monitor for any updates or patches.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for any open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
