Malicious Code Injection in riyanto-poke87 Package
Summary
MAL-2025-165199: Malicious code in riyanto-poke87 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The riyanto-poke87 package is part of the npm ecosystem, often utilized for various JavaScript applications. However, it has been identified as part of a malicious campaign that floods the npm registry with harmful packages. This package is designed to manipulate package metadata and publish numerous derivative packages, which can severely impact developers and the integrity of the npm registry.
Vulnerability Detail
The vulnerability in the riyanto-poke87 package originates from its involvement in the tea.xyz token reward campaign. It contains scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior leads to the continuous republishing of variants, polluting the npm registry and potentially compromising the security of applications that depend on these packages. The malicious payload can inflate developer reputation scores fraudulently, posing a risk to the overall ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall riyanto-poke87If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the riyanto-poke87 package and check your package-lock.json file for any dependencies that might be pulling it in. You can also use the following command to audit your project for vulnerabilities: npm audit.
Conclusion
The riyanto-poke87 package poses a significant risk due to its malicious code designed to manipulate npm registry data. It is essential for developers to remove this package and monitor their applications for vulnerabilities to maintain security and integrity in their projects.
See every vulnerability recorded for riyanto-poke87 →
FAQ
The riyanto-poke87 package is an npm package that has been identified as malicious, designed to manipulate package metadata and publish harmful variants.
This vulnerability can lead to the pollution of the npm registry, potentially compromising the security of your application and inflating developer reputation scores fraudulently.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you have used the riyanto-poke87 package, it is crucial to uninstall it immediately and audit your project for any other vulnerabilities.
Currently, there is no patched version of the riyanto-poke87 package. The best course of action is to remove it from your project.
