Malicious Code Injection in parwo-poke13: A Threat to npm Users
Summary
MAL-2025-163982: Malicious code in parwo-poke13 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parwo-poke13 is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate the distribution of software packages within the npm ecosystem. However, this package has been identified as malicious, containing scripts that automatically publish derivative packages with randomized names, aimed at inflating developer reputation scores for token rewards. This behavior not only clutters the npm registry but also poses significant risks to developers and users relying on npm packages.
Vulnerability Detail
The vulnerability in parwo-poke13 originates from its association with a malicious campaign that floods the npm registry with derivative packages. The package includes scripts (auto.js, autopublish.js, etc.) that modify the package.json file to remove private flags, alter version numbers, and generate random package names. This leads to the continuous republishing of variants, polluting the npm registry and potentially compromising the integrity of other packages. The ramifications include the risk of installing malicious software unknowingly and the degradation of the npm ecosystem's reliability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall parwo-poke13If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the parwo-poke13 package altogether and look for alternative packages that provide similar functionality without the associated risks. Always verify the source and integrity of packages before installation.
Conclusion
The parwo-poke13 package poses a significant threat to the npm ecosystem due to its malicious behavior of generating and publishing derivative packages. It is crucial for developers to be vigilant, remove any affected packages, and utilize tools like Vulert to monitor for vulnerabilities in their projects.
See every vulnerability recorded for parwo-poke13 →
FAQ
parwo-poke13 is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores through the automatic generation of derivative packages.
The vulnerability can lead to the installation of malicious software, cluttering of the npm registry, and potential compromise of your project's integrity.
You should uninstall the package immediately using npm uninstall parwo-poke13 and check your project for any other potentially malicious dependencies.
You can use tools like Vulert, which monitors and alerts you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
