Malicious Code Injection in quiet_gibbon-strongdev Package
Summary
MAL-2025-107660: Malicious code in quiet_gibbon-strongdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The quiet_gibbon-strongdev package is part of the npm ecosystem, typically used for various development tasks. However, it has been identified as part of a malicious campaign that exploits npm's package management system. This package is designed to manipulate its own metadata and create numerous derivative packages, which can lead to reputation inflation and registry pollution.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the quiet_gibbon-strongdev package. This payload alters the package.json file by removing private flags, changing version numbers, and generating random package names. The intent is to automatically publish these variants to the npm registry, thereby compromising the integrity of the registry and potentially affecting developers who rely on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall quiet_gibbon-strongdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the quiet_gibbon-strongdev package and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your package-lock.json file for any unexpected changes or additions.
Conclusion
The quiet_gibbon-strongdev package poses a significant risk due to its malicious code that alters package metadata and publishes unauthorized variants. Immediate action is required to remove this package and safeguard your project from potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for quiet_gibbon-strongdev →
FAQ
It is an npm package that has been identified as part of a malicious campaign to manipulate package metadata and inflate developer reputation scores.
The vulnerability can lead to the automatic publication of malicious packages, compromising the integrity of your project and potentially introducing security risks.
You should uninstall the package immediately and check for any dependencies that may be affected. Use 'npm uninstall quiet_gibbon-strongdev' to remove it.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check your application for vulnerabilities without any signup at the Vulert playground.
Regularly audit your dependencies, keep your packages updated, and utilize tools like Vulert to monitor for vulnerabilities in real-time.
