Malicious Code Injection in solar_booby_dumbs Package
Summary
MAL-2025-108899: Malicious code in solar_booby_dumbs (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The solar_booby_dumbs package is part of the npm ecosystem, often used in various JavaScript projects. It is associated with the tea.xyz token reward campaign, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This package, like others in the campaign, is designed to manipulate the npm registry by creating numerous variants of itself with randomized names.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the solar_booby_dumbs package. This code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, leading to the continuous republishing of these variants. The primary risk is the pollution of the npm registry, which can compromise the integrity of the ecosystem and potentially expose users to further malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall solar_booby_dumbsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the solar_booby_dumbs package altogether. If it is already in use, consider removing it and replacing it with a trusted package that serves a similar purpose. Additionally, monitor your package-lock.json file for any unauthorized changes.
Conclusion
The solar_booby_dumbs package contains malicious code that compromises the integrity of the npm ecosystem. It is crucial to remove this package from your projects and monitor for any unauthorized changes. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for solar_booby_dumbs →
FAQ
The solar_booby_dumbs package is an npm package associated with a token reward campaign that generates and publishes multiple derivative packages to inflate developer reputation scores.
The malicious code modifies your package.json file, potentially exposing your project to further vulnerabilities and polluting the npm registry with unauthorized packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed the solar_booby_dumbs package, you should uninstall it immediately using 'npm uninstall solar_booby_dumbs' and look for secure alternatives.
Currently, there is no patch available for the solar_booby_dumbs package. The best course of action is to remove the package and monitor for any updates from the maintainers.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
