Malicious Code Injection in muda-poke47: A Threat to npm Ecosystem
Summary
MAL-2025-160783: Malicious code in muda-poke47 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
muda-poke47 is a package within the npm ecosystem that is part of the tea.xyz token reward campaign. This package is designed to facilitate the distribution of software and enhance developer reputation scores through token rewards. However, it has been identified as containing malicious code that compromises its integrity and the security of the npm registry.
Vulnerability Detail
The vulnerability in muda-poke47 stems from its inclusion in a series of malicious packages that automatically generate and publish derivative packages with randomized names. These packages are designed to inflate developer reputation scores for tea protocol token rewards. The malicious payload modifies the package.json file to remove private flags, alters version numbers, and continuously republishes variants, leading to pollution of the npm registry and potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall muda-poke47If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using muda-poke47 and any other packages associated with the tea.xyz token reward campaign. Monitor your package dependencies closely and consider using tools like Vulert to identify vulnerabilities in your project. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The discovery of malicious code in the muda-poke47 package highlights the importance of vigilance in managing open-source dependencies. By understanding the nature of this vulnerability and taking proactive steps to secure your projects, you can mitigate risks associated with compromised packages.
See every vulnerability recorded for muda-poke47 →
FAQ
muda-poke47 is an npm package that is part of a token reward campaign, but it has been identified as containing malicious code.
The malicious code modifies package.json files, removes private flags, and repackages the software, which can lead to security vulnerabilities and pollution of the npm registry.
You should uninstall muda-poke47 immediately using the command npm uninstall muda-poke47 and check your project for other potentially affected packages.
Regularly audit your dependencies, keep your packages updated, and use tools like Vulert to monitor for vulnerabilities in real-time.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check for vulnerabilities without needing to install any software.
