Malicious Code Injection in slamet-poke59: A Threat to npm Users
Summary
MAL-2025-166078: Malicious code in slamet-poke59 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
slamet-poke59 is an npm package that appears to be part of a larger campaign aimed at exploiting the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood the npm ecosystem with malicious packages. The primary functionality of slamet-poke59 is to serve as a tool for developers, but its malicious nature compromises the integrity of the npm registry and can lead to significant security risks for users.
Vulnerability Detail
The vulnerability in slamet-poke59 originates from its design to include malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, effectively polluting the npm registry. The malicious payload is part of a broader strategy to inflate developer reputation scores for token rewards, posing a risk of unintentional dependency on compromised packages for developers who may unknowingly install them.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall slamet-poke59If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using slamet-poke59 and any other packages associated with the tea.xyz token reward campaign. Regularly audit your npm packages using 'npm audit' to identify and address any vulnerabilities.
Conclusion
The slamet-poke59 package poses a significant threat to npm users due to its malicious code designed to exploit the npm registry. It is crucial for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities. Immediate action should be taken to remove any instances of this package to safeguard your projects.
See every vulnerability recorded for slamet-poke59 →
FAQ
slamet-poke59 is an npm package that has been identified as malicious, designed to exploit the npm registry for token rewards.
The vulnerability can lead to the installation of compromised packages, which may introduce security risks and affect the integrity of your application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed slamet-poke59, you should uninstall it immediately using 'npm uninstall slamet-poke59' and audit your project for other vulnerabilities.
No patches are available for slamet-poke59 as it is a malicious package. The best course of action is to remove it from your project.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
