Malicious Code Injection in symbolic_grouse-strongdev Package
Summary
MAL-2025-109427: Malicious code in symbolic_grouse-strongdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The symbolic_grouse-strongdev package is part of the npm ecosystem, which is widely used for JavaScript development. This package has been identified as part of a malicious campaign that aims to exploit npm's publishing system. It is designed to automatically generate and publish derivative packages with altered metadata, which can mislead developers and inflate reputation scores for token rewards.
Vulnerability Detail
The vulnerability originates from the package being part of a token reward campaign that floods npm with malicious packages. These packages contain scripts that modify the package.json file to remove private flags, change version numbers, and generate random package names. This leads to pollution of the npm registry and can compromise the integrity of the development environment, potentially allowing for further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall symbolic_grouse-strongdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using npm's package-lock.json file to monitor dependencies. Ensure that your project does not include symbolic_grouse-strongdev in its dependencies. You can also use the following command to uninstall it if already installed: npm uninstall symbolic_grouse-strongdev.
Conclusion
The symbolic_grouse-strongdev package poses a significant risk due to its malicious code designed to exploit npm's publishing system. It is essential to remove this package from your project and monitor for any updates or patches. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for symbolic_grouse-strongdev →
FAQ
The malicious code can lead to the pollution of the npm registry and compromise the integrity of your development environment.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should uninstall the package immediately using the command: npm uninstall symbolic_grouse-strongdev.
Currently, there is no specific patch available for symbolic_grouse-strongdev, but it is recommended to remove the package and monitor for updates.
Vulert uses package-lock.json to monitor your dependencies and alert you in real-time for any open-source vulnerabilities, ensuring your software remains secure.
