Malicious Code Injection in striped_mastodon_replicate_automation Package
Summary
MAL-2025-109198: Malicious code in striped_mastodon_replicate_automation (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The striped_mastodon_replicate_automation package is part of the npm ecosystem, designed to facilitate automation for Mastodon, a decentralized social network. However, this package has been compromised, leading to significant security concerns. The vulnerability stems from its association with a malicious campaign that floods npm with derivative packages, potentially affecting developers' reputations and the integrity of the npm registry.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the striped_mastodon_replicate_automation package. This payload modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which are then continuously republished to pollute the npm registry. This not only compromises the security of the affected package but also poses a risk to the broader npm ecosystem by inflating developer reputation scores through deceptive practices.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall striped_mastodon_replicate_automationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the striped_mastodon_replicate_automation package from your project by executing the command: npm uninstall striped_mastodon_replicate_automation. This will prevent the execution of any malicious code until a secure version is released.
Conclusion
The striped_mastodon_replicate_automation package has been compromised, leading to a significant vulnerability that affects the integrity of the npm ecosystem. It is essential to take immediate action by updating or uninstalling the package to safeguard your projects. Utilizing tools like Vulert can help monitor and alert you to such vulnerabilities in real-time.
See every vulnerability recorded for striped_mastodon_replicate_automation →
FAQ
It is an npm package designed for automation tasks related to the Mastodon social network.
The vulnerability can compromise your project's security by introducing malicious code that alters package configurations and inflates reputation scores.
You should uninstall the package immediately and monitor for updates or patches from the maintainers.
Yes, you can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
