Malicious Code Injection in sari-lodeh56-ruro Package - npm Vulnerability
Summary
MAL-2025-108364: Malicious code in sari-lodeh56-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sari-lodeh56-ruro package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary functionality of such packages is to manipulate the npm registry by generating and publishing numerous derivative packages with altered names and metadata, thereby inflating developer reputation scores for token rewards.
Vulnerability Detail
The vulnerability in the sari-lodeh56-ruro package stems from its malicious payload that modifies the package.json file. This includes removing private flags, changing version numbers, and generating random package names, which can lead to pollution of the npm registry. The origin of this vulnerability is linked to a campaign aimed at exploiting the npm ecosystem for token rewards, making it a significant threat to developers relying on the integrity of the npm registry.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sari-lodeh56-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the sari-lodeh56-ruro package and consider using alternative packages that provide similar functionality without the associated risks. Additionally, regularly audit your npm packages for vulnerabilities using tools like npm audit.
Conclusion
The sari-lodeh56-ruro package poses a significant threat due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be vigilant and take immediate action to remove this package and monitor their projects for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for sari-lodeh56-ruro →
FAQ
The sari-lodeh56-ruro package is an npm package that has been identified as malicious, primarily involved in manipulating the npm registry for token rewards.
This vulnerability can lead to the pollution of the npm registry and may compromise the integrity of your project's dependencies, potentially introducing further security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your package-lock.json file, you can check for vulnerabilities without needing to install any software.
If you find the sari-lodeh56-ruro package in your project, you should uninstall it immediately and look for alternative packages that do not have known vulnerabilities.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like npm audit, and consider using services like Vulert to monitor your projects for vulnerabilities.
