Malicious Code Injection in nana-sroto20-ruro: A Threat to npm Packages
Summary
MAL-2025-106173: Malicious code in nana-sroto20-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'nana-sroto20-ruro' is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the generation of numerous derivative packages. The malicious nature of this package lies in its ability to modify critical files and republish itself under various names, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in 'nana-sroto20-ruro' originates from its association with the tea.xyz token reward campaign. It contains scripts designed to automatically generate and publish derivative packages with randomized names. The malicious payload modifies the package.json file by removing private flags and changing version numbers, which can lead to unauthorized access and manipulation of the npm registry. This behavior not only affects the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nana-sroto20-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'nana-sroto20-ruro' package and any other packages that may be associated with the tea.xyz campaign. Monitor your package-lock.json file for any unauthorized changes and remove any suspicious packages immediately.
Conclusion
The 'nana-sroto20-ruro' package poses a significant threat to the npm ecosystem due to its malicious behavior of modifying package files and republishing itself. It is crucial for developers to remain vigilant, regularly check their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for nana-sroto20-ruro →
FAQ
The main issue is that it contains malicious code that modifies package.json files and republishes itself under different names, compromising the integrity of the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
If you have installed the 'nana-sroto20-ruro' package, you should uninstall it immediately using 'npm uninstall nana-sroto20-ruro' and review your other dependencies for any potential threats.
There are no patches available for the 'nana-sroto20-ruro' package itself, as it is recommended to remove it entirely from your project.
Using compromised npm packages can lead to unauthorized access to your application, data breaches, and the potential for your application to be used for malicious purposes.
