Malicious Code Injection in mental_angelfish_z3n Package
Summary
MAL-2025-88417: Malicious code in mental_angelfish_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mental_angelfish_z3n package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate the automatic generation and publication of derivative packages, which are often used to inflate developer reputation scores in exchange for token rewards. However, its functionality has been compromised, leading to significant security concerns.
Vulnerability Detail
The vulnerability in the mental_angelfish_z3n package stems from the inclusion of malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, which leads to the continuous republishing of variants that pollute the npm registry. The origin of this issue is linked to the tea.xyz token reward campaign, which has been known to flood npm with such malicious packages. The ramifications include potential exposure of sensitive data, unauthorized access to systems, and the degradation of the npm ecosystem's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mental_angelfish_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the mental_angelfish_z3n package by using npm's package-lock.json to monitor dependencies. If you are using Vulert, you can check your application for vulnerabilities without requiring access to the code or installation. Simply use the Vulert playground at https://vulert.com/scanner to see if your application is affected by this vulnerability.
Conclusion
The mental_angelfish_z3n package poses a significant security threat due to its malicious code that alters package configurations and floods the npm registry. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities using tools like Vulert.
See every vulnerability recorded for mental_angelfish_z3n →
FAQ
The mental_angelfish_z3n package is an npm package associated with the tea.xyz token reward campaign, designed to automate the generation and publication of packages.
The vulnerability allows malicious code to modify your package.json file, potentially leading to unauthorized access and data exposure.
You can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
You should uninstall the mental_angelfish_z3n package immediately using the command npm uninstall mental_angelfish_z3n.
It is advisable to look for trusted packages that serve similar functionalities without the associated risks of malicious code.
