Malicious Code Injection in tuti-nasipecel29-wekto: A Threat to npm Ecosystem
Summary
MAL-2025-91294: Malicious code in tuti-nasipecel29-wekto (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tuti-nasipecel29-wekto is part of a series of npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The functionality of this package is compromised due to malicious code that modifies essential files, leading to potential security risks.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the tuti-nasipecel29-wekto package. This payload alters the package.json file by removing private flags, changing version numbers, and generating random package names. The continuous republishing of these variants pollutes the npm registry, posing a risk to developers and users who may unknowingly install these compromised packages. The ramifications include potential exposure to further malicious activities and a degradation of the npm ecosystem's integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tuti-nasipecel29-wektoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the tuti-nasipecel29-wekto package and refrain from installing any packages that appear to be part of the tea.xyz token reward campaign. Monitor your project for any unauthorized changes to package.json and other critical files.
Conclusion
The tuti-nasipecel29-wekto package poses a significant security risk due to its malicious code that alters critical files and pollutes the npm registry. It is essential to remove this package and monitor your projects for any unauthorized changes. Utilizing tools like Vulert can help maintain the security of your open-source dependencies.
See every vulnerability recorded for tuti-nasipecel29-wekto →
FAQ
The impact includes potential exposure to malicious code, which can lead to unauthorized access and manipulation of your project.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the package using npm uninstall tuti-nasipecel29-wekto and review your project for any unauthorized changes.
Currently, there are no patches available for the tuti-nasipecel29-wekto package. The best course of action is to remove it entirely.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about the latest security advisories in the npm ecosystem.
