Malicious Code Injection in metropolitan_python_z3n: A Threat to npm Ecosystem
Summary
MAL-2025-95458: Malicious code in metropolitan_python_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The metropolitan_python_z3n package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and deployment of applications by providing reusable code. However, it has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the creation of derivative packages with randomized names. This behavior not only compromises the integrity of the package but also poses a significant risk to developers who may unknowingly use it.
Vulnerability Detail
The vulnerability in metropolitan_python_z3n originates from its association with the tea.xyz token reward campaign. This package contains scripts designed to automatically generate and publish derivative packages with altered package.json files. The malicious payload removes private flags, modifies version numbers, and creates random package names, leading to pollution of the npm registry. This can result in developers inadvertently using compromised packages, which may contain further vulnerabilities or malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall metropolitan_python_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using metropolitan_python_z3n and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using npm audit to check for vulnerabilities in your project dependencies.
Conclusion
The metropolitan_python_z3n package poses a significant threat due to its malicious code designed to manipulate the npm ecosystem. Developers should take immediate action to remove this package and monitor their dependencies for potential vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your applications.
See every vulnerability recorded for metropolitan_python_z3n →
FAQ
metropolitan_python_z3n is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores by publishing derivative packages.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can quickly identify if your application is affected by this vulnerability.
Using compromised packages can lead to security vulnerabilities in your application, including data breaches, unauthorized access, and potential exploitation by malicious actors.
To prevent vulnerabilities, regularly audit your dependencies, use trusted sources for packages, and stay informed about known vulnerabilities in the npm ecosystem.
Detailed information about this vulnerability can be found in the vulnerability report from Amazon Inspector, which outlines the specifics of the malicious behavior associated with metropolitan_python_z3n.
