Malicious Code Injection in uarg-mitaihai-sufeua: A Threat to npm Packages
Summary
MAL-2025-169596: Malicious code in uarg-mitaihai-sufeua (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package uarg-mitaihai-sufeua is part of a broader campaign targeting npm, where malicious packages are used to manipulate developer reputation scores through the tea.xyz token reward system. These packages often contain scripts that automatically publish derivative versions with altered names and configurations, leading to potential abuse of the npm registry.
Vulnerability Detail
The vulnerability in uarg-mitaihai-sufeua stems from its malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is designed to flood the npm registry with numerous variants, ultimately polluting the ecosystem and compromising the integrity of package management. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which incentivizes developers to inflate their reputation scores through such manipulative practices.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uarg-mitaihai-sufeuaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds for this vulnerability other than removing the affected package. It is advisable to monitor your project for any unauthorized changes to package.json and to use tools that can help identify malicious packages.
Conclusion
The uarg-mitaihai-sufeua package poses a significant risk due to its malicious code that alters package configurations and floods the npm registry. It is crucial for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to safeguard their projects from such vulnerabilities.
See every vulnerability recorded for uarg-mitaihai-sufeua →
FAQ
uarg-mitaihai-sufeua is an npm package that has been identified as malicious, designed to manipulate the npm registry and developer reputation scores.
This vulnerability can lead to unauthorized changes in your project's dependencies, potentially compromising the security and integrity of your application.
You should immediately uninstall the package using npm uninstall uarg-mitaihai-sufeua and review your project for any other potentially malicious dependencies.
Regularly audit your dependencies, use trusted packages, and consider using tools like Vulert to monitor for open-source vulnerabilities in real-time.
Vulert is a tool that monitors and alerts for open-source vulnerabilities using just your package-lock.json file. You can check if your application is affected by visiting the Vulert playground without any signup.
