Malicious Code Injection in political-jade-rat: A Threat to npm Ecosystem
Summary
MAL-2025-95928: Malicious code in political-jade-rat (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'political-jade-rat' is part of a series of malicious npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify critical files and republish variants, thus polluting the npm registry.
Vulnerability Detail
This vulnerability originates from the package's malicious intent to manipulate the package.json file by removing private flags and altering version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to compromise the integrity of the npm registry. The ramifications include potential security risks for developers who unknowingly integrate these packages into their projects, leading to reputation damage and possible exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall political-jade-ratIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the 'political-jade-rat' package and consider using alternative packages that provide similar functionality without the associated risks. Always verify the source and integrity of packages before installation.
Conclusion
The 'political-jade-rat' package poses a significant threat to the npm ecosystem due to its malicious code that modifies package files and republish variants. It is essential for developers to be vigilant about the packages they use and to take immediate action if they discover this vulnerability in their projects.
See every vulnerability recorded for political-jade-rat →
FAQ
It is a malicious npm package designed to inflate developer reputation scores through automated publishing of derivative packages.
Integrating this package can lead to security risks and compromise the integrity of your project's dependencies.
Immediately uninstall the package using 'npm uninstall political-jade-rat' and review your project's dependencies for any other malicious packages.
Regularly update your dependencies, use trusted sources for packages, and consider utilizing tools like Vulert to monitor for vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
