Malicious Code Injection in ugly_python_z3n: A Threat to npm Users
Summary
MAL-2025-123773: Malicious code in ugly_python_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'ugly_python_z3n' is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the creation of numerous derivative packages. The malicious nature of this package lies in its ability to modify critical files and republish itself under various names, thereby polluting the npm registry.
Vulnerability Detail
The vulnerability in 'ugly_python_z3n' originates from its association with the tea.xyz token reward campaign. It contains scripts that automatically generate and publish derivative packages with randomized names, removing private flags from package.json and altering version numbers. This behavior can lead to significant ramifications, including the compromise of the npm registry's integrity and the potential for developers to unknowingly install malicious packages. The technical aspects involve the use of autopublish scripts that continuously republish variants of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ugly_python_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using 'ugly_python_z3n' and any packages that depend on it. Additionally, consider using the following command to uninstall the package: npm uninstall ugly_python_z3n.
Conclusion
The 'ugly_python_z3n' package poses a significant threat to npm users due to its malicious code that modifies package files and repopulates the npm registry with harmful variants. It is crucial to remove this package and monitor your dependencies for potential vulnerabilities.
See every vulnerability recorded for ugly_python_z3n →
FAQ
The main issue is that it contains malicious code designed to modify package.json files and republish itself under various names, which can lead to security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can identify if your application is affected.
If you have installed ugly_python_z3n, you should uninstall it immediately using the command: npm uninstall ugly_python_z3n.
While specific exploits may not be publicly documented, the behavior of the package suggests it can lead to the installation of other malicious packages, compromising the security of your project.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about security advisories related to the packages you use.
