Malicious Code Injection in suharta-poke45: A Threat to npm Users
Summary
MAL-2025-166174: Malicious code in suharta-poke45 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package suharta-poke45 is part of a series of npm packages associated with the tea.xyz token reward campaign. These packages are designed to manipulate the npm registry by creating and publishing numerous derivative packages with randomized names. The primary functionality of suharta-poke45 is to serve as a token reward mechanism, but it has been compromised to include malicious scripts that can harm developers' reputations and pollute the npm ecosystem.
Vulnerability Detail
The vulnerability in suharta-poke45 stems from its inclusion in a malicious campaign that utilizes autopublish scripts to modify package.json files. This manipulation removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of these variants. The ramifications include the potential for developers to unknowingly publish compromised packages, which can damage their reputation and lead to security risks within their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall suharta-poke45If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the suharta-poke45 package by using npm's package-lock.json file to lock dependencies. Additionally, you can monitor your project for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file for any known issues.
Conclusion
The suharta-poke45 package poses a significant risk due to its malicious code designed to manipulate the npm registry. Developers should take immediate action to remove this package and monitor their projects for vulnerabilities using tools like Vulert. Staying informed and proactive is essential to maintaining the integrity of your software.
See every vulnerability recorded for suharta-poke45 →
FAQ
suharta-poke45 is an npm package associated with a token reward campaign that has been compromised to include malicious code.
The malicious code can modify your package.json file, remove private flags, and lead to the creation of numerous derivative packages, potentially harming your project's integrity.
You should remove the suharta-poke45 package from your project immediately and monitor for any updates or patches.
You can use Vulert, which analyzes your package-lock.json file to alert you in real-time about open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
