Malicious Code Injection in putri-kue13-riris Package - npm Vulnerability
Summary
MAL-2025-89676: Malicious code in putri-kue13-riris (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The putri-kue13-riris package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development of applications by providing reusable code components. However, it has been identified as part of a malicious campaign that aims to manipulate the npm registry by generating numerous derivative packages with altered metadata.
Vulnerability Detail
The vulnerability stems from the malicious code embedded in the putri-kue13-riris package. This code is designed to modify the package.json file by removing private flags, changing version numbers, and creating random package names. The intent is to inflate developer reputation scores within the tea.xyz token reward campaign, leading to potential pollution of the npm registry and compromising the integrity of the ecosystem. The malicious payload can affect developers who unknowingly use this package, leading to security risks in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall putri-kue13-ririsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the putri-kue13-riris package and consider replacing it with a reputable alternative. Regularly audit your package dependencies to identify and remove any malicious packages.
Conclusion
The putri-kue13-riris package poses a significant security risk due to its malicious code designed to manipulate the npm registry. It is essential for developers to be vigilant about the packages they use and to take immediate action to remove any affected packages. Regular monitoring and auditing of dependencies can help maintain the integrity of your applications.
See every vulnerability recorded for putri-kue13-riris →
FAQ
It is an npm package that has been identified as part of a malicious campaign to manipulate the npm registry.
Using this package can lead to security risks, including the potential for your application to be compromised or polluted with malicious code.
You should uninstall the package immediately using the command: npm uninstall putri-kue13-riris.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Yes, consider using reputable packages that serve similar functionalities but are verified and trusted within the community.
