Malicious Code Injection in supporting_eel_z3n Package - npm Vulnerability
Summary
MAL-2025-90801: Malicious code in supporting_eel_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The supporting_eel_z3n package is part of the npm ecosystem, often utilized in JavaScript projects for various functionalities. However, it has been identified as part of a malicious campaign linked to the tea.xyz token reward initiative. This campaign has led to the proliferation of numerous packages designed to manipulate developer reputation scores through automated publishing of derivative packages.
Vulnerability Detail
The vulnerability in the supporting_eel_z3n package stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is intended to flood the npm registry with numerous variants, thereby polluting the ecosystem and potentially compromising the integrity of projects that depend on these packages. The malicious payload can lead to unauthorized access and manipulation of project dependencies, posing significant risks to developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall supporting_eel_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the supporting_eel_z3n package and replace it with a trusted alternative that provides similar functionality. Additionally, regularly audit your npm packages using tools like Vulert to monitor for vulnerabilities.
Conclusion
The supporting_eel_z3n package poses a significant security risk due to its malicious code designed to manipulate npm registry entries. It is essential to remove this package from your projects and monitor for similar vulnerabilities using tools like Vulert to maintain the integrity of your software.
See every vulnerability recorded for supporting_eel_z3n →
FAQ
The supporting_eel_z3n package is an npm package that has been identified as part of a malicious campaign aimed at manipulating developer reputation scores.
This vulnerability can lead to unauthorized changes in your project's dependencies, potentially compromising the security and integrity of your application.
You should uninstall the supporting_eel_z3n package immediately and check your package-lock.json for any references to it.
Yes, Vulert can monitor your project for open-source vulnerabilities in real-time using your package-lock.json file. You can check for vulnerabilities without any signup at the Vulert playground.
Regularly audit your dependencies using tools like Vulert and stay updated on security advisories related to the packages you use.
