Malicious Code Injection in samehadaku-messi-cr7 Package
Summary
MAL-2025-165723: Malicious code in samehadaku-messi-cr7 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The samehadaku-messi-cr7 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate the development and deployment of applications by providing reusable code. However, it has been identified as part of a malicious campaign that exploits npm's publishing mechanisms to inflate developer reputation scores through the creation of numerous derivative packages.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the samehadaku-messi-cr7 package. This payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. The malicious scripts (auto.js, autopublish.js, etc.) continuously republish these variants, polluting the npm registry and potentially leading to reputation damage for legitimate developers and security risks for users who inadvertently install these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall samehadaku-messi-cr7If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the samehadaku-messi-cr7 package and replace it with a trusted alternative that provides similar functionality. Always verify the integrity and reputation of packages before installation.
Conclusion
The samehadaku-messi-cr7 package poses a significant risk due to its malicious code designed to manipulate npm's publishing system. It is essential to remove this package from your projects and stay vigilant about the packages you use. Utilizing tools like Vulert can help you maintain the security of your applications.
See every vulnerability recorded for samehadaku-messi-cr7 →
FAQ
The samehadaku-messi-cr7 package is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores by flooding the npm registry with derivative packages.
If your application uses the samehadaku-messi-cr7 package, it may inadvertently contribute to the pollution of the npm registry and expose your project to security risks associated with malicious code.
You should immediately uninstall the samehadaku-messi-cr7 package from your project and review your dependencies for any other potentially malicious packages.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities in your software. You can also check your application against vulnerabilities using the Vulert playground without any signup.
Yes, tools like Vulert can help you identify and monitor vulnerabilities in your project dependencies, ensuring that you are alerted to any potential risks.
