Malicious Code Injection in trevora-cir29: A Threat to npm Users
Summary
MAL-2025-169222: Malicious code in trevora-cir29 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
trevora-cir29 is an npm package that has been implicated in a malicious campaign targeting the npm registry. This package is part of a broader initiative associated with the tea.xyz token reward system, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The package's functionality is compromised, making it a vector for malicious activities.
Vulnerability Detail
The vulnerability in trevora-cir29 stems from its involvement in a malicious campaign that utilizes autopublish scripts to create and publish numerous derivative packages with randomized names. This behavior not only pollutes the npm registry but also modifies the package.json file by removing private flags and altering version numbers. The malicious payload can lead to significant security risks, including the potential exposure of sensitive information and the compromise of developer environments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir29If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the trevora-cir29 package from your project by executing the following command: npm uninstall trevora-cir29. This will prevent any malicious code from executing until a fix is applied.
Conclusion
The trevora-cir29 package poses a significant security risk due to its malicious code injection capabilities. It is crucial for developers to stay informed about such vulnerabilities and take proactive measures to secure their projects. Regular updates and monitoring tools like Vulert can help mitigate these risks effectively.
See every vulnerability recorded for trevora-cir29 →
FAQ
trevora-cir29 is an npm package involved in a malicious campaign that generates and publishes derivative packages to inflate developer reputation scores.
The vulnerability can lead to the modification of your package.json file, potentially exposing sensitive information and compromising your development environment.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, consider uninstalling the package as a temporary measure to prevent any malicious code execution.
For detailed information, you can refer to the vulnerability report on the official GitHub repository or consult security advisories related to npm packages.
