Malicious Code Injection in rival-poke43: A Threat to npm Users
Summary
MAL-2025-165026: Malicious code in rival-poke43 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rival-poke43 is an npm package that has been identified as part of a malicious campaign targeting developers in the npm ecosystem. This package is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of rival-poke43 lies in its ability to manipulate package metadata and flood the npm registry with unwanted variants.
Vulnerability Detail
The vulnerability in rival-poke43 stems from its inclusion in a malicious campaign that utilizes autopublish scripts to alter package.json files. This manipulation removes private flags, modifies version numbers, and generates random package names, leading to the pollution of the npm registry. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which incentivizes developers to publish numerous packages, often at the expense of security and integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rival-poke43If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using rival-poke43 and any packages that may have been published as a result of its malicious activity. Monitor your package-lock.json file for any unauthorized changes and consider using tools like Vulert to scan for vulnerabilities in your project.
Conclusion
The rival-poke43 package poses a significant threat to npm users due to its malicious code designed to manipulate package metadata and flood the npm registry. It is crucial to uninstall this package and monitor your dependencies for any vulnerabilities. Utilizing tools like Vulert can help maintain the security of your projects.
See every vulnerability recorded for rival-poke43 →
FAQ
rival-poke43 is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores through the automatic generation of derivative packages.
The vulnerability can lead to the pollution of the npm registry with unwanted packages, potentially compromising the integrity of your project and affecting its performance.
You should uninstall the rival-poke43 package immediately using the command npm uninstall rival-poke43 and review your other dependencies for any related issues.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check your application for vulnerabilities without any signup at the Vulert playground.
There are no patches available for rival-poke43 as it is a malicious package. The best course of action is to remove it from your project.
