Malicious Code Injection in nurul-kue73-pore Package
Summary
MAL-2025-98189: Malicious code in nurul-kue73-pore (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nurul-kue73-pore package is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to exploit npm's publishing system. It is designed to automatically generate and publish derivative packages, which can lead to reputation inflation for developers involved in the tea.xyz token reward campaign. The vulnerability arises from the package's ability to modify its own metadata and continuously republish variants, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in the nurul-kue73-pore package originates from its inclusion in a malicious campaign that floods the npm registry with derivative packages. The malicious code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior can lead to significant ramifications, including the potential for developers to unknowingly install compromised packages, which can introduce security risks into their applications. The technical aspects of this vulnerability involve the use of autopublish scripts that automate the creation and publication of these malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nurul-kue73-poreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the nurul-kue73-pore package by using npm's package-lock.json file to lock your dependencies. This will ensure that only the specified versions of packages are installed, thereby avoiding the malicious package. You can also use the following command to audit your dependencies for vulnerabilities: npm audit.
Conclusion
The nurul-kue73-pore package poses a significant security risk due to its malicious code that modifies package metadata and repopulates the npm registry with compromised packages. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the security of their applications.
See every vulnerability recorded for nurul-kue73-pore →
FAQ
The nurul-kue73-pore package is an npm package that has been identified as part of a malicious campaign to exploit the npm registry.
The malicious code can modify your package.json file, remove private flags, and republish variants, potentially leading to security risks in your application.
If you have installed the nurul-kue73-pore package, you should uninstall it immediately using the command npm uninstall nurul-kue73-pore.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities in your software.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
