Malicious Code Injection in trevora-cir96: A Threat to npm Users
Summary
MAL-2025-169296: Malicious code in trevora-cir96 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
trevora-cir96 is an npm package that has been identified as part of a malicious campaign targeting developers. This package is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores by flooding the npm registry with derivative packages. The malicious nature of this package lies in its ability to manipulate package metadata and publish harmful variants, posing a significant risk to users and the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in trevora-cir96 originates from its design to execute autopublish scripts that alter the package.json file. It removes private flags, modifies version numbers, and generates random package names, which leads to the continuous republishing of these variants. This behavior not only pollutes the npm registry but also compromises the security of applications that depend on this package, potentially allowing for further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall trevora-cir96If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using trevora-cir96 and replace it with alternative packages that do not exhibit malicious behavior. Additionally, consider using tools like Vulert to monitor your project's dependencies for vulnerabilities. You can check your application for this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The trevora-cir96 package poses a significant risk due to its malicious code designed to manipulate npm package metadata. Users are advised to remove this package and monitor their dependencies closely. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for trevora-cir96 →
FAQ
trevora-cir96 is an npm package involved in a malicious campaign that aims to inflate developer reputation scores by flooding the npm registry with derivative packages.
The vulnerability allows malicious code to modify your package.json file, potentially leading to the installation of harmful packages and compromising your application's security.
You should remove the trevora-cir96 package from your project immediately and monitor your dependencies for any further vulnerabilities.
You can use tools like Vulert, which monitors and alerts you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
