Malicious Code Injection in sweet_nightingale_requirement Package
Summary
MAL-2025-96908: Malicious code in sweet_nightingale_requirement (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sweet_nightingale_requirement package is part of the npm ecosystem, typically used for various JavaScript applications. It is designed to facilitate certain functionalities within the npm environment. However, this package has been identified as part of a malicious campaign that aims to manipulate the npm registry by generating and publishing derivative packages with altered metadata.
Vulnerability Detail
The vulnerability stems from the package's involvement in the tea.xyz token reward campaign, which has been flooding the npm registry with malicious packages. These packages contain scripts that automatically modify the package.json file to remove private flags, change version numbers, and generate random package names. This behavior not only compromises the integrity of the affected package but also pollutes the npm registry, potentially leading to security risks for developers who unknowingly use these malicious derivatives.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sweet_nightingale_requirementIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the sweet_nightingale_requirement package from your project until a secure version is released. Use the following command to uninstall it: 'npm uninstall sweet_nightingale_requirement'.
Conclusion
The sweet_nightingale_requirement package has been identified as a vector for malicious code that compromises the integrity of the npm registry. It is crucial for developers to remain vigilant, regularly update their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for sweet_nightingale_requirement →
FAQ
The malicious code modifies package metadata and repackages it under random names, which can lead to security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, you can check for affected packages.
If an immediate update is not possible, consider removing the package from your project as a temporary measure.
Yes, Vulert provides a playground where you can check if your application is affected by this vulnerability without requiring any signup.
Using compromised packages can lead to data breaches, unauthorized access, and a tarnished reputation for your application.
