Malicious Code Injection in pajero-cir4: A Threat to npm Packages
Summary
MAL-2025-163951: Malicious code in pajero-cir4 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pajero-cir4 is an npm package that has been implicated in a malicious campaign targeting developers in the npm ecosystem. This package is part of a broader initiative that aims to exploit the npm registry by flooding it with derivative packages. The malicious intent behind pajero-cir4 is to manipulate developer reputation scores through automated scripts that publish numerous variants of the package, potentially compromising the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in pajero-cir4 stems from its association with the tea.xyz token reward campaign, which utilizes autopublish scripts to generate and publish numerous derivative packages with randomized names. This malicious behavior modifies the package.json file by removing private flags, altering version numbers, and continuously republishing variants. The ramifications include pollution of the npm registry, which can mislead developers and compromise the security of applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pajero-cir4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using pajero-cir4 in your projects. Instead, consider using alternative packages that provide similar functionality without the associated risks. You can also monitor your package dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Conclusion
The pajero-cir4 package presents a significant risk due to its malicious code designed to manipulate the npm registry. Developers should take immediate action to remove this package and monitor their dependencies for vulnerabilities. Utilizing tools like Vulert can enhance your security posture by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for pajero-cir4 →
FAQ
pajero-cir4 is an npm package that has been identified as part of a malicious campaign aimed at manipulating developer reputation scores through the npm registry.
The vulnerability can lead to the pollution of the npm registry, potentially causing your application to rely on compromised or malicious packages.
You should uninstall pajero-cir4 immediately and monitor your dependencies for any further vulnerabilities.
Yes, tools like Vulert can help monitor your package dependencies for vulnerabilities in real-time without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
