Malicious Code Injection in riyanto-poke52: A Threat to npm Ecosystem
Summary
MAL-2025-165161: Malicious code in riyanto-poke52 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The riyanto-poke52 package is part of a larger ecosystem within npm, primarily associated with the tea.xyz token reward campaign. This package, like others in this campaign, is designed to manipulate the npm registry by generating and publishing derivative packages with randomized names. Its functionality is compromised by the presence of malicious code that alters package metadata, posing a significant risk to developers and the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in riyanto-poke52 originates from its association with the tea.xyz token reward campaign, which floods npm with packages containing autopublish scripts. These scripts are designed to modify the package.json file by removing private flags, changing version numbers, and generating random package names. The continuous republishing of these variants leads to pollution of the npm registry, potentially harming developers' reputations and the overall trust in the ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall riyanto-poke52If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the riyanto-poke52 package from your project by executing the command: npm uninstall riyanto-poke52. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The riyanto-poke52 package poses a significant threat to the npm ecosystem due to its malicious code that alters package metadata and floods the registry with derivative packages. It is crucial for developers to take immediate action by updating or removing the package to safeguard their projects.
See every vulnerability recorded for riyanto-poke52 →
FAQ
Riyanto-poke52 is an npm package that is part of a campaign to manipulate npm's registry by generating and publishing numerous derivative packages.
The vulnerability can lead to the modification of your project's package.json file, potentially compromising its integrity and security.
You should uninstall the package immediately and check for any updates or patches that may address the vulnerability.
Yes, you can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
