Malicious Code Injection in notable_guan_dumbs Package - npm Vulnerability
Summary
MAL-2025-106391: Malicious code in notable_guan_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The notable_guan_dumbs package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and sharing of code. However, it has been identified as part of a malicious campaign that aims to exploit the npm registry by flooding it with derivative packages. The vulnerability stems from the package's inclusion in a larger scheme that manipulates package metadata for fraudulent purposes.
Vulnerability Detail
The vulnerability in the notable_guan_dumbs package originates from its association with the tea.xyz token reward campaign. This campaign utilizes autopublish scripts to generate and publish numerous derivative packages with random names, thereby inflating developer reputation scores. The malicious payload alters the package.json file by removing private flags, changing version numbers, and continuously republishing variants, which pollutes the npm registry. This not only compromises the integrity of the npm ecosystem but also poses risks to developers who may unknowingly incorporate these malicious packages into their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall notable_guan_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the notable_guan_dumbs package and instead look for alternative packages that provide similar functionality without the associated risks. Always verify the integrity and reputation of packages before including them in your projects.
Conclusion
The notable_guan_dumbs package poses a significant risk due to its malicious code designed to manipulate the npm registry. It is essential for developers to be vigilant about the packages they use and to take immediate action to remove any compromised packages. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for notable_guan_dumbs →
FAQ
The notable_guan_dumbs package is an npm package that has been identified as part of a malicious campaign to manipulate the npm registry.
If your project uses the notable_guan_dumbs package, it may inadvertently contribute to the pollution of the npm registry and expose your project to further vulnerabilities.
You should uninstall the notable_guan_dumbs package immediately using the command npm uninstall notable_guan_dumbs.
Regularly audit your dependencies, use trusted packages, and keep your software updated to the latest versions to minimize the risk of vulnerabilities.
Yes, you can use Vulert to monitor your project for open-source vulnerabilities in real-time. It analyzes your package-lock.json file to alert you of any issues.
