Malicious Code Injection in ogi-rendang6-ruro: A Threat to npm Packages
Summary
MAL-2025-106594: Malicious code in ogi-rendang6-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package ogi-rendang6-ruro is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. Its primary function is to facilitate the creation and distribution of JavaScript libraries, but it has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in ogi-rendang6-ruro stems from its inclusion in a malicious campaign that generates and publishes derivative packages with randomized names. This is achieved through scripts that modify the package.json file, removing private flags and altering version numbers. The malicious payload not only inflates developer reputation scores for token rewards but also pollutes the npm registry with numerous variants of the package, potentially leading to security risks for developers who unknowingly use these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ogi-rendang6-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the ogi-rendang6-ruro package and monitor your project for any dependencies that may indirectly rely on it. You can also utilize tools like Vulert to scan your package-lock.json file for vulnerabilities without needing to access the code directly.
Conclusion
The ogi-rendang6-ruro package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry with compromised versions. It is essential for developers to take immediate action by removing the package and monitoring their dependencies for vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your projects.
See every vulnerability recorded for ogi-rendang6-ruro →
FAQ
ogi-rendang6-ruro is an npm package that has been compromised to include malicious scripts as part of a token reward campaign.
If your project uses ogi-rendang6-ruro, it may inadvertently publish malicious packages, compromising your project's integrity and security.
Immediately uninstall the package using npm uninstall ogi-rendang6-ruro and review your project for any other potentially compromised dependencies.
You can use tools like Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software by analyzing your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
