Malicious Code Injection in suharta-poke67: A Threat to npm Users
Summary
MAL-2025-166198: Malicious code in suharta-poke67 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package suharta-poke67 is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to generate and publish derivative packages with randomized names, which can inflate developer reputation scores for token rewards. Its functionality is compromised due to the presence of malicious code that modifies package metadata.
Vulnerability Detail
The vulnerability in suharta-poke67 originates from its malicious intent to manipulate package.json files by removing private flags and altering version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to security risks, including the potential for dependency confusion and reputation damage for developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall suharta-poke67If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually remove the suharta-poke67 package from your project by running the following command: npm uninstall suharta-poke67. Additionally, consider using a package lock file to prevent the installation of malicious packages.
Conclusion
The suharta-poke67 package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry with unwanted variants. It is crucial for developers to remove this package and monitor their projects for similar vulnerabilities using tools like Vulert.
See every vulnerability recorded for suharta-poke67 →
FAQ
suharta-poke67 is an npm package involved in a token reward campaign that has been identified to contain malicious code.
The malicious code modifies your package.json file, potentially leading to security vulnerabilities and reputation issues.
You should uninstall the package immediately and check for any unauthorized changes in your project.
Yes, you can use tools like Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
