Malicious Code Injection in right_bass_0xrequest Package
Summary
MAL-2025-108102: Malicious code in right_bass_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The right_bass_0xrequest package is part of the npm ecosystem, primarily used for handling HTTP requests. It is often leveraged in various JavaScript applications for its simplicity and efficiency. However, this package has been identified as part of a malicious campaign that exploits npm's package publishing system, leading to significant security concerns.
Vulnerability Detail
The vulnerability in the right_bass_0xrequest package stems from its association with the tea.xyz token reward campaign, which has been flooding the npm registry with malicious packages. These packages contain scripts designed to automatically generate and publish derivative packages with altered metadata, including removing private flags and changing version numbers. This behavior can lead to the pollution of the npm registry, potentially affecting developers' reputations and the integrity of their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall right_bass_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the right_bass_0xrequest package from your project until a safe version is released. You can do this by executing: npm uninstall right_bass_0xrequest. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The right_bass_0xrequest package has been identified as containing malicious code that can compromise applications using it. It is essential to take immediate action by updating or removing the package to safeguard your projects. Monitoring tools like Vulert can help keep your dependencies secure.
See every vulnerability recorded for right_bass_0xrequest →
FAQ
The right_bass_0xrequest package is an npm package used for handling HTTP requests in JavaScript applications.
This vulnerability can lead to the injection of malicious code, potentially compromising your application's integrity and security.
You should immediately update or uninstall the right_bass_0xrequest package to prevent any security risks.
You can use Vulert, which monitors and alerts you in real-time for open-source vulnerabilities using just your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
