Malicious Code Injection in muda-poke8: npm Package Vulnerability
Summary
MAL-2025-160790: Malicious code in muda-poke8 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
muda-poke8 is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate interactions within the tea protocol ecosystem. However, it has been identified as a malicious package that employs scripts to manipulate its own metadata and publish numerous derivative packages, thereby inflating developer reputation scores.
Vulnerability Detail
The vulnerability in muda-poke8 originates from its inclusion in a campaign that floods the npm registry with malicious packages. The malicious payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior can lead to the pollution of the npm registry and potentially compromise the integrity of other packages relying on it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall muda-poke8If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the muda-poke8 package and consider alternative packages that provide similar functionality without the associated risks.
Conclusion
The muda-poke8 package has been identified as a malicious entity within the npm ecosystem, capable of altering its own metadata and flooding the registry with harmful derivatives. It is crucial for developers to remove this package and monitor their projects for vulnerabilities using tools like Vulert.
See every vulnerability recorded for muda-poke8 →
FAQ
The vulnerability involves malicious code that modifies package metadata and floods the npm registry with derivative packages.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can alert you in real-time about vulnerabilities.
You should uninstall the package immediately using npm uninstall muda-poke8 and check for any dependencies that may have been affected.
While specific exploits have not been detailed, the manipulation of package metadata poses a risk to the integrity of the npm registry and could lead to further vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
