Malicious Code Vulnerability in rina-ubi86-breki Package
Summary
MAL-2025-75303: Malicious code in rina-ubi86-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rina-ubi86-breki package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages often contain scripts that manipulate package metadata and publish numerous derivative packages to inflate developer reputation scores.
Vulnerability Detail
The vulnerability in the rina-ubi86-breki package stems from its malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior leads to the continuous republishing of these variants, polluting the npm registry and potentially compromising the integrity of the ecosystem. The origin of this vulnerability is linked to a campaign aimed at exploiting npm for token rewards, making it a significant concern for developers relying on the npm registry.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rina-ubi86-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the rina-ubi86-breki package from your project by executing the command: npm uninstall rina-ubi86-breki. This will prevent the malicious code from executing until a secure version is available.
Conclusion
The rina-ubi86-breki package contains a significant vulnerability due to its malicious code that alters package metadata and floods the npm registry. It is essential for developers to take immediate action by uninstalling the package and monitoring their applications for any potential impacts. Utilizing tools like Vulert can help in maintaining the security of your software projects.
See every vulnerability recorded for rina-ubi86-breki →
FAQ
The rina-ubi86-breki package is an npm package that is part of a malicious campaign aimed at exploiting the npm registry for token rewards.
The vulnerability can lead to the pollution of the npm registry, potentially compromising the integrity of your application and affecting its dependencies.
If you have installed the rina-ubi86-breki package, it is crucial to uninstall it immediately and monitor your application for any unusual behavior.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check your application for vulnerabilities without any signup at the Vulert playground.
To prevent similar vulnerabilities, regularly update your dependencies, use tools like Vulert to monitor for vulnerabilities, and review package sources before installation.
