Malicious Code Injection in nokire-nakala6: A Threat to npm Packages
Summary
MAL-2025-163014: Malicious code in nokire-nakala6 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'nokire-nakala6' is part of a series of npm packages that have been associated with the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. This behavior poses a significant risk to the integrity of the npm registry and the security of applications relying on these packages.
Vulnerability Detail
The vulnerability in 'nokire-nakala6' stems from its malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is part of a larger scheme to pollute the npm registry, potentially leading to the distribution of compromised packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which exploits npm's publishing mechanisms to create a flood of derivative packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nokire-nakala6If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the 'nokire-nakala6' package and any other packages associated with the tea.xyz campaign. Implementing strict package auditing and monitoring can help identify and mitigate risks from malicious packages.
Conclusion
The 'nokire-nakala6' package poses a significant threat due to its malicious code designed to manipulate package configurations and pollute the npm registry. It is essential to remove this package from your projects and implement robust monitoring practices to safeguard against similar vulnerabilities in the future.
See every vulnerability recorded for nokire-nakala6 →
FAQ
The main risk is that it contains malicious code that can compromise your application's integrity by modifying package configurations and flooding the npm registry with unauthorized packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
No, there is no patch available for this package. The recommended action is to uninstall it and avoid using it in your projects.
You should immediately uninstall the package using 'npm uninstall nokire-nakala6' and review your project's dependencies for any other potentially malicious packages.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about known vulnerabilities in the packages you use.
