Malicious Code Injection in trevora-cir118: A Threat to npm Ecosystem
Summary
MAL-2025-169171: Malicious code in trevora-cir118 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
trevora-cir118 is a package within the npm ecosystem, which is widely used for JavaScript development. It is part of a larger campaign that exploits npm's package management system to inflate developer reputation scores through the automatic generation and publication of derivative packages. This package, like others in the campaign, is designed to manipulate the npm registry by creating numerous variants of itself, potentially leading to a polluted ecosystem.
Vulnerability Detail
The vulnerability in trevora-cir118 originates from its association with the tea.xyz token reward campaign, which floods npm with malicious packages. The malicious code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, thereby continuously republishing variants. This behavior not only compromises the integrity of the npm registry but also poses a risk to developers who may unknowingly use these tainted packages, leading to potential security breaches in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir118If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using trevora-cir118 and any other packages that are part of the tea.xyz campaign. Instead, consider using alternative packages that provide similar functionality without the associated risks. Always verify the integrity of packages before installation.
Conclusion
The trevora-cir118 package poses a significant threat to the npm ecosystem due to its malicious behavior aimed at manipulating the registry. It is essential for developers to be vigilant, regularly update their dependencies, and utilize tools like Vulert to monitor for vulnerabilities. By taking proactive measures, developers can protect their applications from potential security risks.
See every vulnerability recorded for trevora-cir118 →
FAQ
trevora-cir118 is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores by flooding the npm registry with derivative packages.
Using trevora-cir118 can compromise your application's security by introducing malicious code that modifies your package.json and republishing variants, potentially leading to further exploitation.
You should uninstall the package immediately using the command npm uninstall trevora-cir118 and review your project's dependencies for any other potentially malicious packages.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities. You can check your application against known vulnerabilities using the Vulert playground without any signup.
Yes, look for alternative packages that provide similar functionality but have a good reputation and are actively maintained. Always check the package's documentation and community feedback.
