Malicious Code Vulnerability in sensitive_damselfly_replicate_automation Package
Summary
MAL-2025-108543: Malicious code in sensitive_damselfly_replicate_automation (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sensitive_damselfly_replicate_automation package is part of the npm ecosystem, often utilized for automation tasks. However, this package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the generation of derivative packages. Its functionality has been compromised, making it a vector for malicious activities.
Vulnerability Detail
The vulnerability originates from the package being associated with a token reward campaign that floods npm with malicious packages. It contains scripts designed to automatically modify package.json files, removing private flags, changing version numbers, and generating random package names. This leads to pollution of the npm registry and potential security risks for developers who inadvertently use these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sensitive_damselfly_replicate_automationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually remove the package from your project by executing: npm uninstall sensitive_damselfly_replicate_automation. Additionally, ensure that your package.json does not include any references to this package.
Conclusion
The sensitive_damselfly_replicate_automation package poses a significant risk due to its malicious code designed to manipulate npm registry entries. It is essential to take immediate action to remove this package and safeguard your projects from potential exploitation.
See every vulnerability recorded for sensitive_damselfly_replicate_automation →
FAQ
The vulnerability involves malicious code that modifies package.json files and floods the npm registry with derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
You should uninstall the package immediately and check for any other dependencies that may be affected.
While specific exploits are not detailed, the modification of package.json can lead to unauthorized access and manipulation of your project.
Regularly audit your dependencies, use tools like Vulert for monitoring, and avoid installing packages from untrusted sources.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
