Malicious Code Injection in umi-enting38-miaww Package
Summary
MAL-2025-117616: Malicious code in umi-enting38-miaww (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The umi-enting38-miaww package is part of the npm ecosystem, often used in JavaScript applications for various functionalities. However, this package has been identified as part of a malicious campaign aimed at inflating developer reputation scores through the tea.xyz token reward system. It is designed to automatically generate and publish derivative packages, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the umi-enting38-miaww package. This code modifies the package.json file by removing private flags, altering version numbers, and generating random package names, primarily themed around Indonesian culture. The continuous republishing of these variants can lead to a polluted npm registry, affecting developers and users relying on legitimate packages. The malicious behavior poses a risk of reputation damage and potential security issues for applications that inadvertently depend on these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall umi-enting38-miawwIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the umi-enting38-miaww package and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your project's dependencies using tools like Vulert, which alerts you to open-source vulnerabilities in real-time.
Conclusion
The umi-enting38-miaww package poses a significant risk due to its malicious code designed to manipulate npm registry entries. It is essential to remove this package from your projects and monitor your dependencies closely to maintain application security.
See every vulnerability recorded for umi-enting38-miaww →
FAQ
The umi-enting38-miaww package is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores.
The malicious code modifies your package.json file and can lead to the publication of numerous derivative packages, potentially affecting your application's integrity and security.
You should uninstall the umi-enting38-miaww package immediately and monitor your dependencies for any further vulnerabilities.
Yes, you can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to receive real-time alerts.
To prevent future vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about the packages you include in your projects.
