Malicious Code Injection in sharp_elephant-notthedevs Package
Summary
MAL-2025-108614: Malicious code in sharp_elephant-notthedevs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sharp_elephant-notthedevs package is part of the npm ecosystem, often used in JavaScript applications for various functionalities. However, this package has been identified as part of a malicious campaign that floods the npm registry with harmful scripts designed to manipulate package metadata and inflate developer reputation scores. The presence of such malicious packages poses a significant risk to developers and their applications.
Vulnerability Detail
The vulnerability originates from the sharp_elephant-notthedevs package, which is linked to the tea.xyz token reward campaign. This package contains scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. The malicious payload continuously republishes these variants, polluting the npm registry and potentially compromising applications that depend on this package. The ramifications include unauthorized access to sensitive information and the potential for further exploitation of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sharp_elephant-notthedevsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this malicious package by using npm's package-lock.json to lock your dependencies. Ensure that you do not include sharp_elephant-notthedevs in your package.json file. Additionally, consider using Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The sharp_elephant-notthedevs package poses a significant risk due to its malicious code designed to manipulate package metadata. It is essential to remove this package from your project and monitor your dependencies for vulnerabilities to maintain the security and integrity of your applications.
See every vulnerability recorded for sharp_elephant-notthedevs →
FAQ
sharp_elephant-notthedevs is an npm package that has been identified as part of a malicious campaign to manipulate package metadata.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially compromising your application's integrity and security.
You should uninstall the sharp_elephant-notthedevs package immediately and check your project for any unauthorized changes.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json.
Regularly audit your dependencies, keep them updated, and utilize tools like Vulert to monitor for vulnerabilities.
