Malicious Code Injection in nurul-lapis74-breki: A Threat to npm Ecosystem
Summary
MAL-2025-74648: Malicious code in nurul-lapis74-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'nurul-lapis74-breki' is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. Its primary function is to generate and publish derivative packages, often with randomized names, to inflate developer reputation scores for token rewards. However, this functionality has been compromised, leading to significant security concerns.
Vulnerability Detail
The vulnerability in 'nurul-lapis74-breki' originates from its association with a malicious campaign that modifies the package.json file to remove private flags and change version numbers. It generates random package names and continuously republishes variants, polluting the npm registry. This can lead to unauthorized access, reputation damage for developers, and potential exploitation of users who inadvertently install these malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nurul-lapis74-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the 'nurul-lapis74-breki' package and monitor your dependencies for any unauthorized changes. You can also use tools like Vulert to monitor your package-lock.json for vulnerabilities in real-time.
Conclusion
The 'nurul-lapis74-breki' package poses a significant security risk due to its malicious code designed to manipulate the npm registry. It is crucial for developers to remove this package from their projects and monitor their dependencies for any signs of compromise. Utilizing tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for nurul-lapis74-breki →
FAQ
The vulnerability can lead to unauthorized modifications in your project, potential data breaches, and the proliferation of malicious packages in the npm registry.
You can check your package-lock.json file for the presence of 'nurul-lapis74-breki' and use tools like Vulert to monitor for vulnerabilities.
Regularly audit your dependencies, use trusted sources for packages, and employ tools like Vulert for real-time vulnerability monitoring.
Immediately uninstall the package using 'npm uninstall nurul-lapis74-breki' and check for any unauthorized changes in your project.
Yes, you can report vulnerabilities to the npm security team or through platforms like GitHub where the package is hosted.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
