Malicious Code Vulnerability in messi-urt-efdsdus Package
Summary
MAL-2025-160394: Malicious code in messi-urt-efdsdus (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The messi-urt-efdsdus package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign that has been known to flood the npm registry with malicious packages. It is designed to manipulate developer reputation scores by generating and publishing numerous derivative packages with randomized names, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability in the messi-urt-efdsdus package originates from its malicious intent to modify the package.json file. It removes private flags, alters version numbers, and generates random package names, which can lead to the proliferation of unwanted packages in the npm registry. This not only affects the integrity of the registry but also poses a risk to developers who may unknowingly install these malicious packages, potentially compromising their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall messi-urt-efdsdusIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily avoid using the messi-urt-efdsdus package by removing it from your dependencies. You can do this by executing the following command: npm uninstall messi-urt-efdsdus. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities in real-time.
Conclusion
The messi-urt-efdsdus package poses a significant risk due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be vigilant and remove this package from their projects to maintain the integrity of their applications and the npm ecosystem.
See every vulnerability recorded for messi-urt-efdsdus →
FAQ
The messi-urt-efdsdus package is an npm package associated with a malicious campaign that aims to inflate developer reputation scores through the creation of numerous derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
Using the messi-urt-efdsdus package can lead to the installation of malicious code that may compromise your application and pollute the npm registry with unwanted packages.
Currently, there is no specific patch for the messi-urt-efdsdus package. The best course of action is to uninstall the package and monitor for any updates.
If you have installed the messi-urt-efdsdus package, you should uninstall it immediately using the command: npm uninstall messi-urt-efdsdus.
