Malicious Code Injection in riyanto-124 Package: A Threat to npm Ecosystem
Summary
MAL-2025-165108: Malicious code in riyanto-124 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The riyanto-124 package is part of a broader campaign targeting the npm ecosystem, specifically related to the tea.xyz token reward initiative. This package is designed to manipulate npm's publishing system by creating and publishing numerous derivative packages with randomized names. Its primary function is to inflate developer reputation scores for rewards associated with the tea protocol, but it poses significant risks to the integrity of the npm registry.
Vulnerability Detail
The riyanto-124 package contains malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to a compromised development environment, where developers may inadvertently use malicious packages, risking security breaches and loss of data integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall riyanto-124If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks posed by the riyanto-124 package other than removing it from your project and ensuring that your dependencies are secure.
Conclusion
The riyanto-124 package poses a significant threat to the npm ecosystem due to its malicious behavior aimed at manipulating the package registry. It is crucial for developers to be vigilant and remove any instances of this package from their projects to maintain security and integrity.
See every vulnerability recorded for riyanto-124 →
FAQ
The riyanto-124 package is a malicious npm package involved in a token reward campaign that aims to inflate developer reputation scores.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising security and data integrity.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities. Visit Vulert Scanner to check your application without needing to sign up.
Immediately uninstall the riyanto-124 package and review your dependencies for any other vulnerabilities.
As of now, there is no patched version available. The best course of action is to remove the package entirely.
