Malicious Code Injection in rita-2 Package: npm Vulnerability Overview
Summary
MAL-2025-164889: Malicious code in rita-2 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rita-2 package is part of the npm ecosystem, primarily used for various JavaScript functionalities. However, it has been identified as part of a malicious campaign that floods the npm registry with harmful packages. These packages are designed to manipulate developer reputation scores through automated publishing scripts, which can lead to significant security risks for users and developers alike.
Vulnerability Detail
The vulnerability in the rita-2 package stems from its association with a malicious campaign that modifies the package.json file to remove private flags, changes version numbers, and generates random package names. This behavior not only pollutes the npm registry but also poses risks of unintentional code execution and dependency issues for applications relying on these packages. The malicious payload can lead to compromised systems and data breaches if exploited.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rita-2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the rita-2 package from your project if it is not essential. You can do this by executing 'npm uninstall rita-2'. Additionally, monitor your package-lock.json file for any unexpected changes or dependencies that may arise from malicious packages.
Conclusion
The rita-2 package has been identified as part of a malicious campaign that poses significant security risks. It is essential to take immediate action by updating or removing the package and utilizing tools like Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for rita-2 →
FAQ
The rita-2 package is a JavaScript library available on npm, but it has been identified as part of a malicious campaign that affects its integrity.
The vulnerability can lead to the injection of malicious code, potentially compromising your application's security and integrity.
If you have installed rita-2, it is recommended to uninstall it immediately and check for any other affected packages.
Yes, Vulert can monitor your package-lock.json file for vulnerabilities in real-time, helping you stay informed about potential risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
