Malicious Code Injection in puny_rooster-silentdev Package
Summary
MAL-2025-107428: Malicious code in puny_rooster-silentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The puny_rooster-silentdev package is part of the npm ecosystem, often utilized for various development tasks. However, it has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the creation and publication of derivative packages. This package, like others in the campaign, is designed to manipulate npm registry entries and can lead to significant security risks.
Vulnerability Detail
The vulnerability in the puny_rooster-silentdev package originates from its involvement in the tea.xyz token reward campaign. It contains scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior leads to the continuous republishing of malicious variants, polluting the npm registry and potentially compromising other projects that depend on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall puny_rooster-silentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the puny_rooster-silentdev package from your project by executing: npm uninstall puny_rooster-silentdev. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The puny_rooster-silentdev package has been identified as a vector for malicious code injection, posing significant risks to projects that utilize it. It is crucial to monitor for updates and take necessary actions to secure your applications against this vulnerability.
See every vulnerability recorded for puny_rooster-silentdev →
FAQ
puny_rooster-silentdev is an npm package that has been identified as part of a malicious campaign aimed at manipulating developer reputation scores.
This vulnerability can lead to the pollution of the npm registry, potentially compromising other projects that rely on affected packages and exposing them to security risks.
Check the npm repository for the puny_rooster-silentdev package to see if a patched version has been released. If available, update the package to the latest version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. Visit https://vulert.com for more information.
As a temporary measure, you can uninstall the puny_rooster-silentdev package to mitigate the risk until a secure version is available.
