Malicious Code Injection in operational_jay_z3n: A Threat to npm Users
Summary
MAL-2025-122407: Malicious code in operational_jay_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package operational_jay_z3n is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This campaign has been known to flood the npm registry with malicious packages that contain scripts designed to manipulate package metadata and inflate developer reputation scores. The operational_jay_z3n package is particularly dangerous as it modifies the package.json file to remove private flags, alters version numbers, and generates random package names, leading to potential pollution of the npm registry.
Vulnerability Detail
The vulnerability in operational_jay_z3n originates from its malicious intent to automate the creation and publication of derivative packages. This is achieved through scripts that modify the package.json file, removing critical privacy flags and changing version numbers. The package generates random names, often themed around Indonesian culture, and continuously republishes variants, which can lead to a polluted npm registry and compromise the integrity of the ecosystem. Users of this package may unknowingly contribute to the proliferation of malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall operational_jay_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the effects of this vulnerability other than removing the affected package. Ensure that your package.json does not include operational_jay_z3n and regularly audit your dependencies for any malicious packages.
Conclusion
The operational_jay_z3n package poses a significant threat to npm users due to its malicious code designed to manipulate package metadata and inflate developer reputation scores. Immediate action is required to remove this package from your projects to safeguard against potential risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in your software.
See every vulnerability recorded for operational_jay_z3n →
FAQ
operational_jay_z3n is an npm package associated with a malicious campaign that aims to inflate developer reputation scores through automated publishing of derivative packages.
The vulnerability can lead to the pollution of the npm registry, potentially compromising the integrity of your project and exposing it to further security risks.
You should immediately uninstall the package using the command: npm uninstall operational_jay_z3n to mitigate any risks associated with its use.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Regularly audit your dependencies, use tools like Vulert to monitor for vulnerabilities, and stay informed about the packages you include in your projects.
