Malicious Code Injection in sacred_vicuna_0xrequest Package
Summary
MAL-2025-108319: Malicious code in sacred_vicuna_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sacred_vicuna_0xrequest package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate token rewards for developers by generating and publishing derivative packages. However, it has been identified as containing malicious code that compromises its integrity and the security of applications that depend on it.
Vulnerability Detail
The vulnerability originates from the malicious code embedded in the sacred_vicuna_0xrequest package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The primary goal of this malicious activity is to inflate developer reputation scores for the tea protocol token rewards. The ramifications include potential exposure of sensitive information, pollution of the npm registry with rogue packages, and degradation of the overall security of dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sacred_vicuna_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the sacred_vicuna_0xrequest package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider using tools like Vulert to monitor your dependencies for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without needing to sign up.
Conclusion
The sacred_vicuna_0xrequest package poses a significant security risk due to the malicious code it contains. It is crucial for developers to remove this package from their projects and monitor their dependencies for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for sacred_vicuna_0xrequest →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, designed to generate and publish derivative packages.
The malicious code modifies package.json, removes private flags, and publishes rogue packages, potentially compromising your application's security.
You should uninstall the sacred_vicuna_0xrequest package immediately and look for alternatives.
Yes, you can use Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities without signing up.
