Malicious Code Injection in striking_falcon-tool: A Threat to npm Users
Summary
MAL-2025-109192: Malicious code in striking_falcon-tool (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The striking_falcon-tool is an npm package that is part of a broader ecosystem designed to facilitate token reward campaigns, specifically for the tea.xyz protocol. This package, like others in its category, is intended to assist developers in managing their projects. However, it has been compromised, leading to significant security concerns. The malicious code embedded within this package modifies critical files and repackages them, posing a risk to users who may unknowingly install it.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded in the striking_falcon-tool package. This payload is designed to alter the package.json file by removing private flags, changing version numbers, and generating random package names. The intent behind this malicious activity is to inflate developer reputation scores for token rewards, while simultaneously polluting the npm registry with derivative packages. The ramifications of this vulnerability include potential exposure of sensitive data, unauthorized access to systems, and the degradation of the npm ecosystem's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall striking_falcon-toolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the striking_falcon-tool package until a secure version is released. Additionally, you can manually check your package-lock.json file for any instances of this package and remove it to prevent accidental installations.
Conclusion
The striking_falcon-tool package has been identified as a vector for malicious code that compromises the integrity of npm projects. Users are advised to take immediate action to update or remove the package and utilize tools like Vulert to monitor for vulnerabilities in their applications. Staying informed and proactive is essential in maintaining software security.
See every vulnerability recorded for striking_falcon-tool →
FAQ
The striking_falcon-tool is an npm package associated with the tea.xyz token reward campaign, designed to assist developers but has been compromised with malicious code.
The malicious code modifies your package.json file, potentially exposing sensitive information and leading to unauthorized access or data loss.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If you have installed the striking_falcon-tool package, it is recommended to remove it immediately and update your dependencies to ensure your project is secure.
Regularly updating your packages, using tools like Vulert for monitoring vulnerabilities, and reviewing package dependencies can help prevent future security issues.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
