Malicious Code Injection in Planned Carp Replicate Automation Package
Summary
MAL-2025-107095: Malicious code in planned_carp_replicate_automation (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'planned_carp_replicate_automation' package is part of the npm ecosystem, primarily used for automating tasks related to carp replication. It is designed to streamline processes and enhance productivity for developers. However, this package has been identified as part of a malicious campaign that exploits npm's publishing capabilities, leading to severe security risks.
Vulnerability Detail
This vulnerability originates from a malicious payload embedded within the 'planned_carp_replicate_automation' package. It modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which are then republished to the npm registry. This behavior not only pollutes the registry but also compromises the integrity of the developer's reputation and can lead to unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall planned_carp_replicate_automationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'planned_carp_replicate_automation' package from your project by executing 'npm uninstall planned_carp_replicate_automation'. This will prevent any malicious code from executing while you assess the situation.
Conclusion
The 'planned_carp_replicate_automation' package poses a significant security risk due to its malicious code that alters package metadata and republishing behavior. It is crucial for developers to remain vigilant, regularly update their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for planned_carp_replicate_automation →
FAQ
The malicious code modifies the package.json file, removes private flags, and generates random package names to inflate developer reputation scores.
You can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for any issues.
Using this package can lead to unauthorized access to your project's dependencies, reputation damage, and potential data breaches.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay updated on security advisories related to your packages.
Immediately remove the affected package, update your dependencies, and review your project's security practices to prevent future incidents.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
