Malicious Code Injection in thorough_meerkat-gooddev Package
Summary
MAL-2025-109630: Malicious code in thorough_meerkat-gooddev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thorough_meerkat-gooddev package is part of the npm ecosystem, typically used for various development tasks. However, it has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This package is particularly vulnerable due to its association with the tea.xyz token reward scheme, which exploits npm's publishing mechanisms.
Vulnerability Detail
The vulnerability stems from the package's involvement in a malicious campaign that modifies its package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is designed to continuously republish variants, polluting the npm registry and potentially compromising the integrity of other packages. The malicious payload can lead to significant ramifications, including the spread of untrusted code and the degradation of the npm ecosystem's reliability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall thorough_meerkat-gooddevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the thorough_meerkat-gooddev package from your project by executing the command: npm uninstall thorough_meerkat-gooddev. This will prevent any potential exploitation while you assess alternative packages.
Conclusion
The thorough_meerkat-gooddev package is compromised by malicious code that can significantly affect the integrity of your application. It is crucial to take immediate action by updating or removing the package to safeguard your project. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for thorough_meerkat-gooddev →
FAQ
The vulnerability involves malicious code that modifies package metadata and repackages it, leading to potential security risks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Using this package can lead to the introduction of untrusted code into your application, potentially compromising security and functionality.
Regularly audit your dependencies and utilize tools like Vulert to monitor for vulnerabilities in real-time.
If an immediate update is not possible, consider removing the package and looking for alternatives until a secure version is available.
