Malicious Code Injection in round_tern_0xrequest Package: A Threat to npm Users
Summary
MAL-2025-108219: Malicious code in round_tern_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The round_tern_0xrequest package is part of the npm ecosystem, primarily used for JavaScript development. It is designed to facilitate certain functionalities within applications but has been compromised as part of a broader malicious campaign targeting npm. This package is associated with the tea.xyz token reward initiative, which has led to the proliferation of numerous derivative packages that aim to manipulate developer reputation scores.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the round_tern_0xrequest package. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names, which can lead to the continuous republishing of these variants. This not only pollutes the npm registry but also poses a significant risk to developers who may unknowingly install these compromised packages, potentially leading to security breaches and loss of sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall round_tern_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the round_tern_0xrequest package from your project by executing the command: npm uninstall round_tern_0xrequest. This will prevent any malicious code from executing until a safe version is available.
Conclusion
The round_tern_0xrequest package poses a significant security threat due to its malicious code that alters package configurations and repopulates the npm registry with compromised versions. It is essential for developers to stay vigilant, update their packages, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for round_tern_0xrequest →
FAQ
It is an npm package used in JavaScript development, but it has been compromised with malicious code.
The malicious code can modify your package.json, remove private flags, and republish variants, leading to potential security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should uninstall the package immediately and check for any updates or patches that address the vulnerability.
Regularly update your packages, use tools like Vulert for monitoring, and review package dependencies to ensure they are from reputable sources.
