Malicious Code Injection in siregar-poke61: A Threat to npm Packages
Summary
MAL-2025-165982: Malicious code in siregar-poke61 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The siregar-poke61 package is part of the npm ecosystem, often utilized in various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. This package, like others in the campaign, is designed to manipulate package metadata and publish derivative versions, posing a significant risk to developers and users alike.
Vulnerability Detail
The vulnerability in siregar-poke61 stems from its malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to clutter the npm registry. This behavior can lead to reputation inflation for malicious actors and potentially compromise the integrity of applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall siregar-poke61If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the siregar-poke61 package and any other packages associated with the tea.xyz token reward campaign. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The siregar-poke61 package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry. It is crucial for developers to be vigilant, remove affected packages, and utilize monitoring tools like Vulert to safeguard their applications from such vulnerabilities.
See every vulnerability recorded for siregar-poke61 →
FAQ
siregar-poke61 is an npm package that is part of a malicious campaign aimed at inflating developer reputation scores through the creation of derivative packages.
The malicious code modifies your package.json file, potentially exposing your application to further vulnerabilities and cluttering the npm registry with unwanted packages.
You should uninstall the siregar-poke61 package immediately and check for any dependencies that may be affected. Use 'npm uninstall siregar-poke61' to remove it.
Regularly update your packages, utilize tools like Vulert for real-time monitoring, and review package dependencies before installation.
Yes, you can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
