Malicious Code Injection in uafagarug-mifi-sut Package
Summary
MAL-2025-169449: Malicious code in uafagarug-mifi-sut (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uafagarug-mifi-sut package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate the automatic generation and publication of derivative packages, which can inflate developer reputation scores. However, it has been identified as containing malicious code that modifies package.json files and republishes variants to pollute the npm registry.
Vulnerability Detail
The vulnerability in the uafagarug-mifi-sut package originates from its malicious intent to automate the creation of derivative packages with randomized names. This behavior not only compromises the integrity of the npm registry but also poses risks to developers who may unknowingly use these tainted packages. The malicious payload modifies critical fields in package.json, such as removing private flags and altering version numbers, which can lead to unintended consequences in dependent projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uafagarug-mifi-sutIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the uafagarug-mifi-sut package and instead look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your project for any dependencies that may have been affected by this malicious package.
Conclusion
The uafagarug-mifi-sut package has been identified as containing malicious code that can compromise the integrity of projects using it. It is essential to remove this package and monitor for any potential impacts on your dependencies. Utilizing tools like Vulert can help in identifying vulnerabilities in your projects.
See every vulnerability recorded for uafagarug-mifi-sut →
FAQ
The uafagarug-mifi-sut package is an npm package involved in the tea.xyz token reward campaign, designed to automate the publication of derivative packages.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising its integrity and security.
If you have used the uafagarug-mifi-sut package, it is crucial to remove it from your project and monitor for any dependencies that may have been affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Vulert is a tool that uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software, helping developers maintain secure applications.
