Malicious Code Injection in rival-poke32: A Threat to npm Users
Summary
MAL-2025-165014: Malicious code in rival-poke32 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rival-poke32 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate various functionalities within the npm ecosystem. However, it has been identified as part of a malicious scheme that floods the npm registry with derivative packages, affecting the integrity and security of the ecosystem.
Vulnerability Detail
The vulnerability in rival-poke32 originates from its association with a malicious campaign that utilizes autopublish scripts to generate and publish numerous derivative packages. These scripts modify the package.json file by removing private flags, altering version numbers, and creating random package names. The continuous republishing of these variants leads to pollution of the npm registry, potentially compromising the security of applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rival-poke32If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the rival-poke32 package from your project by executing: npm uninstall rival-poke32. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The rival-poke32 package has been identified as a vector for malicious code injection, posing a significant risk to users within the npm ecosystem. It is crucial to update or remove this package to safeguard your applications from potential threats.
See every vulnerability recorded for rival-poke32 →
FAQ
The vulnerability involves malicious code that modifies package.json and floods the npm registry with derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
As a workaround, you can uninstall the rival-poke32 package to mitigate the risk until a secure version is released.
Yes, this campaign has affected multiple packages within the npm ecosystem, primarily those associated with the tea.xyz token reward scheme.
The vulnerability was reported by Amazon Inspector, a tool that helps identify security issues in software packages.
