Malicious Code Injection in rudi-bakwan84-riris Package
Summary
MAL-2025-90241: Malicious code in rudi-bakwan84-riris (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rudi-bakwan84-riris package is part of the npm ecosystem, often utilized for various JavaScript applications. It has been identified as part of a malicious campaign that floods the npm registry with derivative packages. This package is designed to inflate developer reputation scores through automated scripts that publish numerous variants of itself, often with randomized names.
Vulnerability Detail
The vulnerability in the rudi-bakwan84-riris package stems from its inclusion in a campaign that modifies package.json files to remove private flags, alters version numbers, and generates random package names. This malicious behavior leads to the pollution of the npm registry, potentially compromising the integrity of applications that depend on this package. The origin of this issue is linked to the tea.xyz token reward campaign, which exploits npm's publishing capabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rudi-bakwan84-ririsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using npm's package-lock.json file to monitor dependencies. Ensure that your project does not include rudi-bakwan84-riris or any of its variants. You can also use the following command to audit your dependencies: npm audit.
Conclusion
The rudi-bakwan84-riris package is associated with a malicious campaign that poses significant risks to applications using it. Immediate action is required to remove this package and ensure the integrity of your software. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for rudi-bakwan84-riris →
FAQ
It is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through automated publishing.
The vulnerability can lead to the pollution of the npm registry, potentially introducing malicious code into your application if the package is used.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
You should uninstall the rudi-bakwan84-riris package immediately using the command: npm uninstall rudi-bakwan84-riris.
Due to the nature of this package, it is recommended to uninstall it rather than rely on a patch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
