Malicious Code Injection in muda-poke3: A Threat to npm Users
Summary
MAL-2025-160764: Malicious code in muda-poke3 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
muda-poke3 is an npm package that has been identified as part of a malicious campaign targeting developers. This package is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of muda-poke3 lies in its ability to modify package.json files, remove private flags, and publish numerous variants to the npm registry, thereby polluting it.
Vulnerability Detail
The vulnerability in muda-poke3 stems from its malicious code that alters the package.json file by removing private flags and changing version numbers. This behavior is part of a broader scheme to generate random package names and continuously republish them, which can lead to reputation inflation for developers involved in the tea protocol token rewards. The ramifications of this vulnerability include potential exposure of sensitive information, unauthorized package modifications, and an overall degradation of the npm registry's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall muda-poke3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the muda-poke3 package from your project by executing the following command: npm uninstall muda-poke3. This will prevent any malicious code from executing while you assess the situation.
Conclusion
The muda-poke3 package poses a significant threat due to its malicious code that alters package.json files and publishes unauthorized variants. It is essential for developers to take immediate action by uninstalling the package and monitoring their projects for vulnerabilities. Utilizing tools like Vulert can help in maintaining the security of your software.
See every vulnerability recorded for muda-poke3 →
FAQ
muda-poke3 is an npm package that has been linked to a malicious campaign aimed at inflating developer reputation scores through automated package publishing.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing sensitive information and degrading the integrity of the npm registry.
If you have installed muda-poke3, it is crucial to uninstall the package immediately and check for any unauthorized changes in your project.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application for vulnerabilities using the Vulert playground without any signup.
To prevent similar vulnerabilities, regularly update your dependencies, use tools like Vulert for monitoring, and review package sources before installation.
