Malicious Code Injection in uaragifa-ma-sf Package: npm Vulnerability Overview
Summary
MAL-2025-169541: Malicious code in uaragifa-ma-sf (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uaragifa-ma-sf package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is linked to the tea.xyz token reward campaign, notorious for flooding the npm registry with malicious packages. Its primary function is to facilitate the distribution of JavaScript code, but it has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in the uaragifa-ma-sf package stems from its association with a malicious campaign that employs scripts to automatically generate and publish derivative packages. These scripts modify the package.json file by removing private flags, altering version numbers, and creating random package names. This behavior not only inflates developer reputation scores for token rewards but also pollutes the npm registry, potentially leading to security risks for developers who unknowingly install these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uaragifa-ma-sfIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the uaragifa-ma-sf package and monitor your project for any dependencies that may indirectly include it. Regularly check your package-lock.json file for any signs of malicious packages.
Conclusion
The uaragifa-ma-sf package poses a significant security risk due to its malicious code designed to manipulate package metadata and pollute the npm registry. It is crucial for developers to remain vigilant, regularly check their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for uaragifa-ma-sf →
FAQ
The uaragifa-ma-sf package is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through the distribution of compromised packages.
You can check your project for vulnerabilities by using tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time.
If you have installed the uaragifa-ma-sf package, you should uninstall it immediately using the command npm uninstall uaragifa-ma-sf.
Yes, tools like Vulert can help you monitor your project for vulnerabilities without requiring access to the code or installation.
Using compromised packages can lead to security vulnerabilities, data breaches, and the potential for malicious code execution in your application.
