Malicious Code Vulnerability in uinsnu-lotimi-killer Package
Summary
MAL-2025-169756: Malicious code in uinsnu-lotimi-killer (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uinsnu-lotimi-killer package is part of a broader campaign associated with the tea.xyz token reward system, which has been known to flood the npm registry with malicious packages. This package is designed to manipulate npm's publishing system, potentially impacting developers' reputations and the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the uinsnu-lotimi-killer package. This code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, leading to the automatic creation and publication of derivative packages. This behavior not only pollutes the npm registry but also poses risks to developers who may unknowingly use these compromised packages, potentially leading to security breaches and loss of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uinsnu-lotimi-killerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the uinsnu-lotimi-killer package and monitor your project for any dependencies that may have inadvertently included it. Regularly audit your package-lock.json file to identify and remove any malicious packages.
Conclusion
The uinsnu-lotimi-killer package presents a significant security risk due to its malicious code designed to manipulate npm's publishing system. Developers are advised to remove this package and monitor their projects for any dependencies that may have included it. Utilizing tools like Vulert can help in identifying vulnerabilities and maintaining the integrity of your applications.
See every vulnerability recorded for uinsnu-lotimi-killer →
FAQ
It is a malicious npm package associated with a token reward campaign that modifies package metadata and publishes derivative packages.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities. Visit Vulert Scanner to check your application without signup.
Using this package can lead to security vulnerabilities, reputation damage, and the pollution of the npm registry with malicious content.
Currently, there is no patched version available. The best course of action is to uninstall the package and monitor for updates.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about known vulnerabilities in the npm ecosystem.
