Malicious Code Injection in shilang-poke33: A Threat to npm Users
Summary
MAL-2025-165851: Malicious code in shilang-poke33 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
shilang-poke33 is an npm package that has been identified as part of a larger campaign to exploit the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood the npm ecosystem with malicious packages. The primary functionality of shilang-poke33 is to act as a token reward mechanism, but it has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in shilang-poke33 stems from its inclusion in a malicious campaign that utilizes autopublish scripts to generate and publish derivative packages with randomized names. These scripts modify the package.json file to remove private flags, alter version numbers, and create random package names, thereby polluting the npm registry. The ramifications of this vulnerability include potential reputational damage to developers, increased risk of dependency confusion, and the proliferation of malicious packages that can compromise other projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shilang-poke33If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the shilang-poke33 package from your project by executing the following command: npm uninstall shilang-poke33. This will prevent any malicious code from executing while you assess alternative solutions.
Conclusion
The shilang-poke33 package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry. It is crucial for developers to take immediate action by removing the package and monitoring their projects for any signs of compromise. Utilizing tools like Vulert can help in maintaining the security of your applications.
See every vulnerability recorded for shilang-poke33 →
FAQ
shilang-poke33 is an npm package that has been linked to a malicious campaign aimed at exploiting the npm registry.
The vulnerability can lead to the injection of malicious code, potentially compromising your project and affecting its integrity.
You should uninstall the package immediately and monitor your project for any unusual behavior.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Regularly audit your dependencies, use tools like Vulert to monitor for vulnerabilities, and stay informed about the packages you include in your projects.
