Malicious Code Vulnerability in trevora-cir77: Exploitation of npm Registry
Summary
MAL-2025-169275: Malicious code in trevora-cir77 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package trevora-cir77 is part of the npm ecosystem, which is widely used for JavaScript package management. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages often contain scripts designed to manipulate package metadata and inflate developer reputation scores for token rewards, making them a significant threat to the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in trevora-cir77 originates from its association with malicious scripts that modify the package.json file. These scripts remove private flags, alter version numbers, and generate random package names, leading to the continuous republishing of variants that pollute the npm registry. This not only compromises the security of the affected package but also affects the overall reliability of the npm ecosystem, as it can mislead developers and users about the authenticity and safety of packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir77If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to avoid using the trevora-cir77 package altogether. If you have dependencies that rely on it, consider finding alternative packages that provide similar functionality without the associated risks.
Conclusion
The trevora-cir77 package poses a significant threat due to its malicious code designed to manipulate the npm registry. It is essential for developers to be vigilant about the packages they use and to regularly check for vulnerabilities. By utilizing tools like Vulert, developers can proactively manage their dependencies and maintain the security of their applications.
See every vulnerability recorded for trevora-cir77 →
FAQ
trevora-cir77 is an npm package that has been identified as part of a malicious campaign aimed at manipulating the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
Using trevora-cir77 can lead to security vulnerabilities, including the exposure of sensitive data and the potential for your application to be compromised through malicious code.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities. Additionally, avoid using packages from untrusted sources.
Immediately uninstall the package using npm uninstall trevora-cir77 and check for any other malicious packages that may have been installed.
