Malicious Code Injection in splendid_wildebeest-toolteadev Package
Summary
MAL-2025-109023: Malicious code in splendid_wildebeest-toolteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The splendid_wildebeest-toolteadev package is part of the npm ecosystem, often utilized in various JavaScript projects for development purposes. However, this package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This behavior compromises the integrity of the npm registry and poses significant risks to developers using this package.
Vulnerability Detail
The vulnerability stems from the package being associated with a token reward campaign that floods the npm registry with malicious packages. The malicious code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This leads to the continuous republishing of variants, which can pollute the npm registry and potentially expose developers to security risks and reputation damage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall splendid_wildebeest-toolteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the splendid_wildebeest-toolteadev package from your project by executing the following command: npm uninstall splendid_wildebeest-toolteadev. This will prevent any malicious code from executing while you assess alternative packages or wait for a secure version.
Conclusion
The splendid_wildebeest-toolteadev package has been identified as containing malicious code that can compromise the integrity of projects using it. Developers are advised to update or remove the package to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for splendid_wildebeest-toolteadev →
FAQ
The malicious code is designed to modify package.json files, remove private flags, and generate random package names, leading to the pollution of the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Using this package can expose your project to security risks, including the potential for malicious code execution and damage to your developer reputation.
Regularly audit your dependencies, utilize tools like Vulert for monitoring vulnerabilities, and stay updated on security advisories for the packages you use.
If an immediate update is not possible, consider removing the package from your project as a temporary measure until a secure version is available.
