Malicious Code Injection in suharta-poke79: A Threat to npm Users
Summary
MAL-2025-166211: Malicious code in suharta-poke79 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The suharta-poke79 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary functionality of suharta-poke79 is to serve as a component in this campaign, but it has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in suharta-poke79 originates from its design to automatically generate and publish derivative packages with randomized names. This is executed through scripts that modify the package.json file, removing private flags and altering version numbers. The malicious payload not only inflates developer reputation scores for token rewards but also leads to the pollution of the npm registry with potentially harmful packages. This can result in security risks for developers who unknowingly install these compromised packages, leading to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall suharta-poke79If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can prevent the installation of this malicious package by using npm's audit feature to identify vulnerabilities in your project. Run 'npm audit' to get a report of known vulnerabilities and take necessary actions based on the findings.
Conclusion
The suharta-poke79 package poses a significant risk due to its malicious code designed to manipulate package metadata and inflate developer reputation scores. It is essential for developers to be vigilant in monitoring their dependencies and to take immediate action to remove any compromised packages. Utilizing tools like Vulert can aid in maintaining the security of your projects.
See every vulnerability recorded for suharta-poke79 →
FAQ
suharta-poke79 is an npm package that is part of a malicious campaign designed to inflate developer reputation scores through the publication of compromised packages.
The malicious code modifies your package.json file, potentially exposing your project to further vulnerabilities and pollution of the npm registry.
You should uninstall the package immediately using 'npm uninstall suharta-poke79' and check for any other compromised packages in your project.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time. You can also check your application using the Vulert playground without needing to sign up.
Regularly audit your npm packages using 'npm audit', keep your dependencies updated, and consider using tools like Vulert for real-time monitoring.
