Malicious Code Injection in shilang-poke7: A Threat to npm Users
Summary
MAL-2025-165891: Malicious code in shilang-poke7 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
shilang-poke7 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate the distribution of tokens through various npm packages. However, it has been identified as containing malicious code that can compromise the integrity of the npm registry and the applications that depend on it.
Vulnerability Detail
The vulnerability in shilang-poke7 originates from its malicious payload, which modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants, leading to pollution of the npm registry. This behavior can inflate developer reputation scores fraudulently and potentially introduce harmful code into dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shilang-poke7If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, you can remove the shilang-poke7 package from your project by executing the following command: npm uninstall shilang-poke7. This will prevent any malicious code from executing in your application until a secure version is released.
Conclusion
The shilang-poke7 package poses a significant threat due to its malicious code that alters package metadata and repackages itself. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in real-time.
See every vulnerability recorded for shilang-poke7 →
FAQ
The shilang-poke7 package contains malicious code that modifies package.json files and republishes variants to pollute the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed shilang-poke7, it is crucial to uninstall it immediately and monitor for any updates or patches from the maintainers.
Yes, using npm packages can pose risks, especially if they contain malicious code. It's essential to regularly audit your dependencies and stay informed about vulnerabilities.
To prevent similar vulnerabilities, regularly update your dependencies, use tools like Vulert for monitoring, and review the code of packages before including them in your project.
