Malicious Code Exploit in precious_emu_requirement Package
Summary
MAL-2025-95968: Malicious code in precious_emu_requirement (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The precious_emu_requirement package is part of the npm ecosystem, which is widely used for managing JavaScript packages. This package was identified as part of a malicious campaign that aimed to exploit npm's publishing mechanisms. It is designed to facilitate the automatic generation and publication of derivative packages, which can lead to significant pollution of the npm registry and compromise developer reputations.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the precious_emu_requirement package. This code is part of a broader scheme associated with the tea.xyz token reward campaign, which involves the use of autopublish scripts. These scripts modify the package.json file to remove private flags, alter version numbers, and generate random package names, thus allowing the continuous republishing of these variants. This not only clutters the npm registry but also poses a risk of unintentional dependency on compromised packages by developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall precious_emu_requirementIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the vulnerable package by using the npm shrinkwrap feature or by specifying exact versions of dependencies in your package.json file to avoid unintended updates.
Conclusion
The precious_emu_requirement package has been identified as containing malicious code that poses significant risks to developers and the npm ecosystem. It is crucial to take immediate action to mitigate these risks by updating or removing the package and utilizing tools like Vulert for ongoing monitoring.
See every vulnerability recorded for precious_emu_requirement →
FAQ
The malicious code is designed to modify package.json files, remove private flags, and continuously republish variants of the package to inflate developer reputation scores.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application by visiting the Vulert playground at Vulert Scanner without any signup.
Using this package can lead to dependency on malicious code, which may compromise your application's integrity and security, as well as pollute the npm registry.
Regularly audit your dependencies, use tools like Vulert for monitoring vulnerabilities, and ensure that you only install packages from trusted sources.
If an immediate update is not possible, consider removing the package from your project and look for alternative packages that provide similar functionality without the associated risks.
