Malicious Code Injection in nokire-rara91: A Threat to npm Users
Summary
MAL-2025-163385: Malicious code in nokire-rara91 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'nokire-rara91' is part of a campaign that exploits the npm ecosystem, specifically targeting developers involved with the tea.xyz token reward program. This package is designed to manipulate npm's publishing system, generating numerous derivative packages with the intent of inflating developer reputation scores. Its functionality revolves around automatic publishing scripts that create and disseminate variants of the package, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in 'nokire-rara91' stems from its malicious code that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. This behavior not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly use these tainted packages. The origin of this malicious activity is linked to a broader scheme aimed at exploiting npm for token rewards, which can lead to significant reputational damage for developers and potential security risks for applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nokire-rara91If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of 'nokire-rara91' by adding it to your npm ignore list or by using a package manager that allows you to specify safe versions. Additionally, you can monitor your dependencies using tools like Vulert, which alerts you to vulnerabilities in real-time without requiring code access.
Conclusion
The 'nokire-rara91' package presents a significant threat to npm users due to its malicious code designed to manipulate package publishing. It is crucial for developers to be vigilant, remove any affected packages, and utilize monitoring tools like Vulert to safeguard their projects against such vulnerabilities.
See every vulnerability recorded for nokire-rara91 →
FAQ
'nokire-rara91' is a malicious npm package that is part of a campaign to exploit the npm ecosystem for token rewards.
The vulnerability can lead to the installation of compromised packages, which may alter your project's dependencies and introduce security risks.
You should immediately uninstall the package using 'npm uninstall nokire-rara91' and check your package-lock.json for any references.
You can use Vulert to monitor your project for open-source vulnerabilities in real-time by analyzing your package-lock.json file.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about known vulnerabilities in the npm ecosystem.
