Malicious Code Exploit in munya-mipt-munio: A Threat to npm Packages
Summary
MAL-2025-160979: Malicious code in munya-mipt-munio (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
munya-mipt-munio is an npm package that has been identified as part of a malicious campaign targeting the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood npm with various packages. The primary functionality of this package is to serve as a tool for developers, but its integrity has been compromised due to the malicious code embedded within it. The vulnerability allows for the automatic generation and publication of derivative packages, which can significantly impact the npm ecosystem.
Vulnerability Detail
The vulnerability in munya-mipt-munio originates from its association with a malicious campaign that utilizes autopublish scripts to create and publish numerous derivative packages with randomized names. These scripts modify the package.json file to remove private flags, alter version numbers, and continuously republish variants, thereby polluting the npm registry. This not only inflates developer reputation scores for the tea protocol token rewards but also poses a risk of dependency confusion and potential exploitation of other packages relying on this ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall munya-mipt-munioIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can remove the munya-mipt-munio package from their project until a secure version is released. This can be done by executing the following command: npm uninstall munya-mipt-munio. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities. Vulert can analyze your package-lock.json file to alert you in real-time about any open-source vulnerabilities.
Conclusion
The munya-mipt-munio package has been identified as a malicious entity within the npm ecosystem, posing significant risks to developers and their projects. It is crucial to take immediate action by removing the package and monitoring for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for munya-mipt-munio →
FAQ
munya-mipt-munio is an npm package that has been compromised and is part of a malicious campaign targeting the npm registry.
The vulnerability can lead to the automatic generation of malicious packages, which may compromise your project's dependencies and overall security.
You should uninstall the munya-mipt-munio package immediately and monitor your project for any potential vulnerabilities.
Yes, you can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
Regularly update your packages, use tools like Vulert for monitoring, and review package dependencies for any known vulnerabilities.
