Malicious Code Injection in rinto-poke19: A Threat to npm Ecosystem
Summary
MAL-2025-164788: Malicious code in rinto-poke19 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rinto-poke19 is an npm package that is part of a broader campaign targeting developers through token rewards. It is designed to facilitate certain functionalities within the npm ecosystem, but it has been compromised to serve malicious purposes. The package has been identified as part of a series of malicious packages that flood the npm registry, potentially harming developers and users by altering package integrity and reputation.
Vulnerability Detail
The vulnerability in rinto-poke19 originates from its association with the tea.xyz token reward campaign, which employs malicious scripts to manipulate package.json files. These scripts remove private flags, alter version numbers, and generate random package names, leading to the continuous republishing of variants that pollute the npm registry. This not only compromises the integrity of the affected package but also affects the overall trustworthiness of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rinto-poke19If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the rinto-poke19 package from your project by executing the command: npm uninstall rinto-poke19. This will prevent any malicious code from executing while you seek a secure alternative or wait for a patched version.
Conclusion
The rinto-poke19 package has been compromised, posing significant risks to developers and users within the npm ecosystem. It is crucial to take immediate action by updating or removing the package to safeguard your applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for rinto-poke19 →
FAQ
The vulnerability involves malicious code that alters package.json files, enabling the automatic generation and publication of derivative packages with random names.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include compromised package integrity, pollution of the npm registry, and potential security risks for applications relying on the affected package.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just package-lock.json.
If you cannot update the package, consider uninstalling it as a temporary measure to mitigate risks until a secure version is available.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
