Malicious Code Injection in motionless_bug_z3n: A Threat to npm Packages
Summary
MAL-2025-105981: Malicious code in motionless_bug_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
motionless_bug_z3n is an npm package that is part of a broader campaign aimed at exploiting the npm registry. This package, like many others involved in the tea.xyz token reward scheme, is designed to manipulate developer reputation scores by automatically publishing derivative packages with randomized names. The malicious nature of this package poses a significant risk to developers and the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in motionless_bug_z3n originates from its involvement in a malicious campaign that floods the npm registry with derivative packages. The package contains scripts that modify the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior not only inflates developer reputation scores but also pollutes the npm registry, making it difficult for developers to find legitimate packages. The potential ramifications include compromised package integrity and increased risk of dependency confusion attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall motionless_bug_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the motionless_bug_z3n package and any other packages that are part of the tea.xyz token reward campaign. Regularly check your package-lock.json file for any unauthorized changes and remove any suspicious packages immediately.
Conclusion
The motionless_bug_z3n package poses a significant risk due to its malicious behavior aimed at manipulating npm registry integrity. It is essential for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, developers can protect their projects from potential threats.
See every vulnerability recorded for motionless_bug_z3n →
FAQ
motionless_bug_z3n is an npm package involved in a malicious campaign that aims to inflate developer reputation scores through the automatic publishing of derivative packages.
This vulnerability can compromise the integrity of your project by introducing malicious code and polluting the npm registry, making it harder to find legitimate packages.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
If you find motionless_bug_z3n in your dependencies, immediately uninstall it using npm uninstall motionless_bug_z3n and audit your other packages for similar vulnerabilities.
Yes, tools like Vulert can help monitor your dependencies for vulnerabilities using just your package-lock.json file, providing alerts in real-time.
