Malicious Code Injection in raw_anteater_dumbs Package - npm Vulnerability
Summary
MAL-2025-107741: Malicious code in raw_anteater_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The raw_anteater_dumbs package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package, like others in the campaign, is designed to manipulate the npm registry by automatically generating and publishing derivative packages. It aims to inflate developer reputation scores for rewards associated with the tea protocol. The package's functionality is compromised due to the presence of malicious scripts that alter its metadata.
Vulnerability Detail
The vulnerability in the raw_anteater_dumbs package originates from its association with a malicious campaign that floods the npm registry with derivative packages. The malicious payload modifies the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior leads to the pollution of the npm registry, potentially affecting other developers and users who rely on the integrity of the packages. The scripts involved are designed to continuously republish these variants, exacerbating the issue.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall raw_anteater_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the raw_anteater_dumbs package from your project by executing the following command: npm uninstall raw_anteater_dumbs. This will prevent the malicious code from executing in your environment until a fix is applied.
Conclusion
The raw_anteater_dumbs package contains a significant vulnerability that allows for malicious code injection, leading to the pollution of the npm registry. It is crucial to take immediate action by updating or uninstalling the package to protect your project and maintain the integrity of your development environment.
See every vulnerability recorded for raw_anteater_dumbs →
FAQ
The raw_anteater_dumbs package is a part of the npm ecosystem and is linked to a token reward campaign that generates and publishes derivative packages to inflate developer reputation scores.
The vulnerability can lead to the pollution of the npm registry, potentially compromising the integrity of your project and affecting other developers who rely on the affected packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If you cannot update the package, consider uninstalling it as a temporary measure to mitigate the risk until a fix is available.
Detailed information about this vulnerability can be found in the official npm registry and through security advisories related to the raw_anteater_dumbs package.
