Malicious Code Injection in Redundant Sailfish Plum-22 Package
Summary
MAL-2025-107801: Malicious code in redundant_sailfish_plum-22 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redundant Sailfish Plum-22 is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate the automatic generation and publication of derivative packages. This package has been identified as malicious due to its functionality that modifies package.json files and inflates developer reputation scores through the creation of numerous derivative packages with randomized names.
Vulnerability Detail
The vulnerability originates from the malicious intent behind the package, which includes scripts that automatically publish derivative packages. These scripts alter the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior can lead to pollution of the npm registry, making it difficult for developers to find legitimate packages and potentially compromising the integrity of their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall redundant_sailfish_plum-22If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually remove the package from your project by executing the command: npm uninstall redundant_sailfish_plum-22. Additionally, ensure to review your package.json file for any unauthorized changes.
Conclusion
The Redundant Sailfish Plum-22 package contains malicious code that can compromise the integrity of applications. It is crucial to update or remove the package to mitigate risks associated with this vulnerability. Regular monitoring and auditing of dependencies are essential for maintaining security.
See every vulnerability recorded for redundant_sailfish_plum-22 →
FAQ
The impact includes potential pollution of the npm registry and compromised integrity of applications using the affected package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your packages.
If you cannot update, consider removing the package and replacing it with a safer alternative.
It may lead to unexpected behavior in your application and complicate dependency management, making it harder to maintain a secure and stable environment.
