Malicious Code Injection in trevora-cir75: A Threat to npm Users
Summary
MAL-2025-169273: Malicious code in trevora-cir75 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package trevora-cir75 is part of the npm ecosystem, which is widely used for JavaScript package management. It is often utilized by developers to manage dependencies in their applications. However, this package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. This behavior poses significant risks to the integrity of the npm registry and the applications relying on these packages.
Vulnerability Detail
The vulnerability in trevora-cir75 stems from its association with a malicious campaign that modifies package.json files to remove private flags, alters version numbers, and generates random package names. This results in the continuous republishing of variants, which pollutes the npm registry and can lead to unintended consequences for developers who unknowingly incorporate these packages into their projects. The malicious payload is designed to exploit the npm ecosystem for token rewards, compromising the security and reliability of the packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir75If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the trevora-cir75 package and monitor your dependencies for any malicious packages. You can also utilize tools like Vulert to check your package-lock.json for vulnerabilities without needing to install any software. Use the Vulert playground at https://vulert.com/scanner to assess if your application is affected by this vulnerability.
Conclusion
The trevora-cir75 package poses a significant risk due to its malicious code designed to exploit the npm ecosystem. It is crucial for developers to remain vigilant and regularly check their dependencies for vulnerabilities. By following the recommended steps to remove the package and utilizing tools like Vulert, developers can safeguard their applications against such threats.
See every vulnerability recorded for trevora-cir75 →
FAQ
trevora-cir75 is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores through the automatic generation of derivative packages.
If your application depends on trevora-cir75, it may inadvertently include malicious code that can compromise its security and integrity.
You should uninstall the package immediately using npm uninstall trevora-cir75 and check your package-lock.json for any references to it.
Yes, regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check your package-lock.json for vulnerabilities without any signup or installation.
