Malicious Code Injection in melodic_ermine_replicate_automation Package
Summary
MAL-2025-105773: Malicious code in melodic_ermine_replicate_automation (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The melodic_ermine_replicate_automation package is part of the npm ecosystem, primarily used for automation tasks related to the tea.xyz token reward campaign. This package is designed to facilitate the generation and publication of derivative packages. However, it has been compromised, leading to significant security concerns due to its malicious functionalities.
Vulnerability Detail
The vulnerability stems from the package being part of a malicious campaign that floods the npm registry with fake packages. It contains scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior not only inflates developer reputation scores but also pollutes the npm registry, making it difficult for legitimate packages to be discovered. The malicious payload can lead to unauthorized access and manipulation of projects that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall melodic_ermine_replicate_automationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the melodic_ermine_replicate_automation package from your project by executing: npm uninstall melodic_ermine_replicate_automation. This will prevent the malicious code from executing until a fix is applied.
Conclusion
The melodic_ermine_replicate_automation package has been identified as containing malicious code that poses significant risks to applications relying on it. Immediate action is required to mitigate these risks, either through updates or removal of the package. Regular monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for melodic_ermine_replicate_automation →
FAQ
The primary risk is the potential for unauthorized modifications to your project's dependencies, leading to security breaches and compromised application integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, consider removing the package as a temporary measure to prevent exploitation of the vulnerability.
While specific exploits may not be publicly documented, the nature of the malicious code suggests that it could lead to significant security risks, including unauthorized access to sensitive data.
It is advisable to regularly check for vulnerabilities, ideally as part of your continuous integration/continuous deployment (CI/CD) pipeline, to ensure your application remains secure.
