Malicious Code Injection in riyanto-poke73 Package: A Threat to npm Users
Summary
MAL-2025-165184: Malicious code in riyanto-poke73 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The riyanto-poke73 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary function of such packages is to inflate developer reputation scores through automated publishing scripts, which can lead to significant security risks for users relying on these packages.
Vulnerability Detail
The vulnerability in the riyanto-poke73 package originates from its design to include malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, thereby republishing variants to pollute the npm registry. The ramifications of this vulnerability include potential exposure of sensitive information, misuse of developer reputation, and the introduction of unstable or harmful code into dependent projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall riyanto-poke73If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the riyanto-poke73 package and any other packages associated with the tea.xyz token reward campaign. Regularly audit your package dependencies using tools like npm audit to identify and mitigate vulnerabilities.
Conclusion
The riyanto-poke73 package poses a significant security threat due to its malicious code designed to manipulate package metadata and inflate developer reputation. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the integrity of their projects.
See every vulnerability recorded for riyanto-poke73 →
FAQ
The riyanto-poke73 package is an npm package that has been identified as malicious, designed to inflate developer reputation scores through automated publishing.
The malicious code modifies your package.json file, potentially exposing sensitive information and introducing unstable code into your project.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If you have installed the riyanto-poke73 package, you should uninstall it immediately using npm uninstall riyanto-poke73 and review your dependencies.
Yes, tools like Vulert can help you monitor your package-lock.json file for vulnerabilities in real-time, ensuring your application remains secure.
