Malicious Code Injection in numerous_mole_dumbs Package: npm Vulnerability Overview
Summary
MAL-2025-106410: Malicious code in numerous_mole_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The numerous_mole_dumbs package is part of the npm ecosystem, primarily used for various development purposes. However, it has been identified as part of a malicious campaign associated with the tea.xyz token reward system. This campaign involves the creation of numerous derivative packages that aim to inflate developer reputation scores through automated publishing scripts. The package's functionality is compromised due to its involvement in this malicious activity, making it a significant risk for developers who may unknowingly use it.
Vulnerability Detail
The vulnerability stems from the numerous_mole_dumbs package being part of a malicious campaign that modifies its package.json file to remove private flags and change version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to developers inadvertently using compromised packages, resulting in potential security risks and reputation damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall numerous_mole_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the numerous_mole_dumbs package and replace it with a trusted alternative. Always review the dependencies in your package-lock.json file to ensure no malicious packages are included.
Conclusion
The numerous_mole_dumbs package poses a significant security risk due to its involvement in a malicious campaign that modifies package metadata and floods the npm registry with compromised packages. Developers should take immediate action to remove this package and monitor their projects for vulnerabilities.
See every vulnerability recorded for numerous_mole_dumbs →
FAQ
The numerous_mole_dumbs package is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores through automated publishing.
Using the numerous_mole_dumbs package can expose your project to security risks, including the potential for malicious code execution and reputation damage.
You should immediately uninstall the numerous_mole_dumbs package from your project and review your dependencies for any other potentially malicious packages.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check your application for vulnerabilities using the Vulert playground without any signup.
There is no patch for the numerous_mole_dumbs package as it is recommended to remove it entirely from your project.
