Malicious Code Injection in Roasted Python Z3N Package
Summary
MAL-2025-98912: Malicious code in roasted_python_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'roasted_python_z3n' package is part of the npm ecosystem, often utilized for various JavaScript functionalities. However, it has been identified as part of a malicious campaign that aims to exploit npm's package publishing system. This package is linked to the tea.xyz token reward initiative, which has been associated with generating numerous derivative packages to manipulate developer reputation scores.
Vulnerability Detail
The vulnerability in 'roasted_python_z3n' is rooted in its malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to clutter the npm registry. This behavior not only compromises the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these tainted packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall roasted_python_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'roasted_python_z3n' package altogether and look for alternative packages that provide similar functionalities without the associated risks.
Conclusion
The 'roasted_python_z3n' package poses significant risks due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be vigilant and remove any affected packages while utilizing tools like Vulert to monitor for vulnerabilities in their projects.
See every vulnerability recorded for roasted_python_z3n →
FAQ
The primary risk is the injection of malicious code that can alter your project's package.json file and lead to the proliferation of unwanted packages in the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can help identify if your application is affected.
You should immediately uninstall the package and check for any other affected packages in your project. Use the command: npm uninstall roasted_python_z3n.
Yes, Vulert provides a playground where you can check your application for vulnerabilities without needing to sign up. Visit Vulert Scanner to use it.
Ignoring this vulnerability can lead to security breaches, data corruption, and the potential for your application to be used for malicious purposes, affecting both your reputation and that of the npm ecosystem.
