Malicious Code Detected in modest_platypus_z3n: A Threat to npm Ecosystem
Summary
MAL-2025-105937: Malicious code in modest_platypus_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modest_platypus_z3n is an npm package that has been identified as part of a malicious campaign targeting the npm registry. This package, like others in the tea.xyz token reward scheme, is designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package poses a significant risk to developers and users relying on npm for package management.
Vulnerability Detail
The vulnerability in modest_platypus_z3n originates from its involvement in a broader malicious campaign that floods the npm registry with spammy packages. The package contains scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior not only pollutes the npm registry but also compromises the integrity of the software supply chain, potentially leading to further exploitation and misuse of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall modest_platypus_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the modest_platypus_z3n package from your project by executing the following command: npm uninstall modest_platypus_z3n. This will prevent any malicious code from executing while you assess the situation and look for a secure alternative.
Conclusion
The modest_platypus_z3n package has been identified as malicious, posing significant risks to the npm ecosystem. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for modest_platypus_z3n →
FAQ
The threat involves malicious scripts that modify package metadata and flood the npm registry with spammy packages, potentially compromising the integrity of your applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate update is not possible, consider uninstalling the package as a temporary measure to mitigate the risk while you plan for a secure alternative.
While specific exploits have not been detailed, the behavior of the package suggests that it could lead to further exploitation of affected systems through the pollution of the npm registry.
Regularly audit your dependencies, utilize tools like Vulert for monitoring, and stay informed about the latest security advisories related to the packages you use.
