Malicious Code Injection in trevora-cir85: A Threat to npm Packages
Summary
MAL-2025-169284: Malicious code in trevora-cir85 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package trevora-cir85 is part of the npm ecosystem, which is widely used for JavaScript package management. It is designed to facilitate the development and distribution of JavaScript libraries and applications. However, trevora-cir85 has been identified as part of a malicious campaign that floods the npm registry with harmful packages. These packages are often created to inflate developer reputation scores through automated scripts that generate and publish numerous derivative packages with altered names and contents.
Vulnerability Detail
The vulnerability in trevora-cir85 stems from its association with a malicious campaign that modifies the package.json file to remove private flags, changes version numbers, and generates random package names. This behavior is part of a broader scheme to pollute the npm registry by continuously republishing variants of the package, which can lead to security risks for developers who unknowingly use these compromised packages. The malicious payload can compromise the integrity of applications relying on trevora-cir85, potentially leading to unauthorized access or data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir85If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using trevora-cir85 and any other packages that are part of the malicious campaign. Regularly audit your dependencies using tools like npm audit or Vulert to identify and mitigate vulnerabilities in your project. You can also use the Vulert playground at https://vulert.com/scanner to check if your application is affected by this vulnerability without needing to sign up.
Conclusion
The trevora-cir85 package poses a significant security risk due to its malicious code that modifies package metadata and floods the npm registry. It is crucial for developers to remove this package and regularly audit their dependencies to maintain the integrity of their applications. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities effectively.
See every vulnerability recorded for trevora-cir85 →
FAQ
trevora-cir85 is an npm package that has been identified as part of a malicious campaign to flood the npm registry with harmful packages.
The vulnerability can compromise the integrity of your application by introducing malicious code that may lead to unauthorized access or data breaches.
You should uninstall the package immediately using npm uninstall trevora-cir85 and check your project for any remnants of the package.
You can use tools like npm audit or Vulert, which monitors your package-lock.json for vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by vulnerabilities without needing to sign up.
