Malicious Code Injection in ultimate_guppy_z3n Package - npm Vulnerability
Summary
MAL-2025-109967: Malicious code in ultimate_guppy_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ultimate_guppy_z3n package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is suspected to be associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages often contain scripts designed to manipulate package metadata and inflate developer reputation scores, posing a significant risk to users and the integrity of the npm registry.
Vulnerability Detail
The vulnerability in the ultimate_guppy_z3n package stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior leads to the continuous republishing of variants that can pollute the npm registry, potentially compromising the security of applications that depend on this package. The malicious payload is designed to exploit the npm ecosystem by creating derivative packages with randomized names, making it difficult for developers to track and manage their dependencies effectively.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ultimate_guppy_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the ultimate_guppy_z3n package from your project by executing the following command: npm uninstall ultimate_guppy_z3n. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The ultimate_guppy_z3n package poses a significant risk due to its malicious code that modifies package metadata and repopulates the npm registry with harmful variants. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications.
See every vulnerability recorded for ultimate_guppy_z3n →
FAQ
The ultimate_guppy_z3n package is an npm package that is part of a malicious campaign aimed at manipulating the npm registry and inflating developer reputation scores.
This vulnerability can compromise the integrity of your application by introducing malicious code that modifies package metadata and republishing variants that can pollute the npm registry.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If you cannot update the package, consider removing it from your project as a temporary measure until a secure version is released.
More information about this vulnerability can be found in the official GitHub repository of the malicious packages or through security advisories related to npm packages.
