Malicious Code Injection in sari-serimuka95-ruro Package: A Threat to npm Users
Summary
MAL-2025-108384: Malicious code in sari-serimuka95-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sari-serimuka95-ruro package is part of a series of malicious packages that emerged during the tea.xyz token reward campaign, which aimed to manipulate npm's ecosystem. This package, like others in its category, is designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. Its functionality is primarily centered around the npm registry, where it can significantly disrupt the integrity of package management.
Vulnerability Detail
The vulnerability in the sari-serimuka95-ruro package stems from its malicious code, which modifies the package.json file to remove private flags and alters version numbers. This allows the package to generate random Indonesian-themed names and continuously republish variants, effectively polluting the npm registry. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has been associated with numerous similar malicious packages. The ramifications include potential security risks for developers who unknowingly install these packages, leading to compromised projects and reputational damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sari-serimuka95-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the sari-serimuka95-ruro package and refrain from installing any packages that appear to be part of the tea.xyz token reward campaign. Regularly audit your dependencies to identify and remove any potentially malicious packages.
Conclusion
The sari-serimuka95-ruro package poses a significant threat to npm users due to its malicious code designed to manipulate the npm registry. It is crucial to remain vigilant, regularly audit dependencies, and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, developers can protect their projects from potential security risks.
See every vulnerability recorded for sari-serimuka95-ruro →
FAQ
The sari-serimuka95-ruro package is a malicious npm package that is part of a campaign to inflate developer reputation scores through automated publishing of derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
Using the sari-serimuka95-ruro package can lead to security vulnerabilities in your project, including the potential for unauthorized access and manipulation of your codebase.
It is recommended to audit your npm packages regularly, ideally after every major update or installation, to ensure that no malicious packages have been introduced.
If you have installed the sari-serimuka95-ruro package, immediately uninstall it using 'npm uninstall sari-serimuka95-ruro' and check for any other potentially malicious packages in your project.
